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EXECUTIVE SUMMARY 


This report presents the results of a study, funded by the Federal Aviation Administration (FAA), 
of crash-resistant fuel system (CRFS) technology for large transport category airplanes. 
Research efforts over the years led to the development and installation of CRFSs in all U.S. 
Army helicopters, resulting in the virtual elimination of postcrash fire fatalities in Army 
helicopter accidents. The transference of this technology to civil aircraft has been very slow. 
Although the level of fuel system crash resistance in civil helicopters has been improved during 
recent years, very little has been done for fixed-wing aircraft of any size. The focus of this study 
is to assess the status of CRFS technology in current large transport category airplanes and to 
provide recommendations for the integration of available state-of-the-art CRFS technology into 
those airplanes. 

Efforts to understand the postcrash fire problem of large airplanes and to improve the crash 
resistance of their fuel systems began over 50 years ago with research and test efforts conducted 
by the National Advisory Committee for Aeronautics (NACA) National Aeronautical and Space 
Administration (NASA) and Civil Aviation Authority (CAA) FAA. The U.S. Army began its 
efforts to develop CRFSs for its helicopters and small fixed-wing aircraft 40 years ago and began 
installing them in production helicopters 10 years later. These efforts are summarized in some 
detail to provide the reader with a firm background in the principles of CRFS design as well as in 
the technology which was developed. 

The transference of the CRFS technology to large transport category airplanes is not simple. The 
fuel systems of current large transport airplanes are much more complex and varied than those in 
the small fixed-wing and helicopter structures. The vast difference in size poses a problem in 
establishing simple design criteria for a generic CRFS for large transport airplanes. Whereas the 
structure and all the occupants of smaller aircraft experience roughly the same crash 
environment, this is not the case in the larger transport airplanes. These are significant 
differences in the structural damage suffered, and in the resultant crash loads transmitted to the 
occupants, in various parts of these large aircraft. As a result, the diversity of the crash 
environment in which a CRFS must function successfully is extensive. For this reason, CRFS 
design criteria might better be established based upon anticipated structural displacement 
coupled with anticipated crash loads, based on typical crash scenarios as determined by detailed 
crash investigations and test programs, rather than crash loads alone. In any case, what little 
crash testing has been done on large transport airplanes clearly shows that the crash G loads 
specified by current regulations are not adequate. The testing also shows that current large 
transport fuselage auxiliary fuel tanks cannot withstand survivable crash scenarios without 
leaking. 

A review of the available accident data is of little help in establishing the level of current fuel 
system crash performance. Although the occurrence of fire is reported in the accident reports, 
the number of fatalities caused by the fire, as opposed to impact, is often not available or is 
unreliable. The effect of the crash on the fuel system and its components is not reported. 
Similarly, the reports on structural damage are inadequate to establish crash vectors, crash forces, 
structural displacements, and other necessary structural behavior patterns. The inadequacy of 
current available crash data underscores the need for the training of field investigators in specific 
crashworthiness technology and data collection. 



CRFS design principles and technology are described and discussed together with the status of 
CRFS technology implementation in current large transport airplanes. Some CRFS components 
and subsystems could be integrated immediately with minimal impact on design. However, 
there are many areas of CRFS design that require more research before they can be implemented 
in large transport airplanes. False information, not critically challenged, has retarded the 
development of some easily accomplished CRFS improvements. 

Current and proposed regulations applicable to large transport fuel systems are summarized and 
analyzed with respect to CRFS designs. The impact of the new “Mega-AC” system is discussed. 

This report provides information to the FAA and other governmental organizations that can 
assist their efforts to improve the crash resistance of large transport category airplane fuel 
systems. 


1. INTRODUCTION. 


Postcrash fires account for a high percentage of injuries and fatalities in aircraft accidents that 
would, in the absence of such fires, be survivable. The successful development and 
implementation of crash-resistant fuel systems by the U.S. Army in its rotorcraft fleet has proven 
that technology is available to virtually eliminate fire fatalities in otherwise survivable helicopter 
accidents. The transference of this technology to civil aircraft has been slow in the several 
decades since the Army implemented this technology. Although the level of crash resistance in 
some civil helicopters has been improved over the years, progress has been uneven. Very little 
has been done for fixed-wing aircraft of any size. 

Efforts to understand the postcrash fire problem of large airplanes and to improve the crash 
resistance of their fuel systems began over 50 years ago with research and test efforts conducted 
by the National Advisory Committee for Aeronautics (NACA), National Aeronautical and Space 
Administration (NASA), Civil Aviation Authority (CAA), and Federal Aviation Administration 
(FAA). The FAA has been active in this effort ever since and, in 1989, issued an Advanced 
Notice of Proposed Rulemaking (ANPRM 89-11) to determine the feasibility of installing, in all 
air carrier aircraft, crashworthy fuselage fuel tanks and fuselage fuel lines which are rupture 
resistant and which disconnect and seal in the event of an accident. Although no further 
rulemaking has been proposed, the FAA is still desirous of improving the crash resistance of 
transport airplane fuel systems and would like to issue a new NPRM to implement available 
crashworthy technology into current versions of transport category airplanes. 

To support this effort, the FAA contracted with Robertson Aviation to assess the current crash- 
resistant fuel system (CRFS) technology applicable to Title 14 Code of Federal Regulations 
(CFR) Part 25 transport category airplanes and, based on this assessment, to recommend future 
testing and changes necessary to implement CRFS technology into transport airplanes. The 
scope of this program included the review and evaluation of (1) prior historical studies in aircraft 
fire research, (2) design and test efforts associated with CRFS components and fuel containment 
concepts, (3) available crash test data for transport category aircraft, and (4) pertinent transport 
airplane crash reports and data. Fuel system designs and CRFS technology currently used in 
transport airplanes were to be documented and their probable behavior in typical survivable 
accidents analyzed. Current CRFS technology was to be compared with available state-of-the- 
art fuel system technology and recommendations made for the integration of CRFS technology 
into current transport airplane designs. Recommendations also were to be proposed for future 
testing that would provide sufficient data for the issuance of a new NPRM. 

This report begins in section 2 with a summary and analysis of the history of CRFS 
development, including work done by NASA, the FAA, and the U.S. Army. The implementation 
of CRFS technology into military and civil rotorcraft and the ongoing efforts to improve the 
crash fire safety of fixed-wing aircraft are discussed. 

Section 3 reviews and analyzes the available data from crash tests of modem transport airplanes 
for its applicability to CRFS design. Additional testing under varying conditions is identified. 

Transport airplane accident data studies are reviewed in section 4. Emphasis is on those of the 
jet transport era, and a number of special studies and reports from committees established for this 



purpose are summarized. Some significant accidents during the recent past are reviewed. The 
roles that accident data and its collection play in CRFS development also are discussed, 
including the inadequacy of current available data. 

Section 5 reviews the general design of transport aircraft fuel systems, with descriptive 
examples. There is an incredibly wide variety of designs. Many new aircraft are entering the 
market with new features, like fuel in the horizontal tail section, that make the overall design 
problem much more difficult than in helicopters. 

Current CRTS design principles and technology are described and discussed in section 6, along 
with the status of CRFS technology implementation in current transport airplanes. A matrix 
illustrating current fuel systems used in transport category airplanes versus available state-of-the- 
art CRFS technology is provided. This matrix highlights those areas most in need of 
improvement. 

CRFS evaluation methods are contained in section 7. A rating system is described to evaluate 
the postcrash fire potential of a fuel system. Although developed for small fixed-wing and 
helicopter fuel systems, this rating system, when suitably modified, would be very valuable in 
assisting the designer of a transport airplane CRFS. The section also contains an evaluation 
technique that can determine the relative “fire hazard level” for each fuel system component 
and/or hazardous area. This technique allows the designer to make optimum selection of designs 
and components. 

Section 8 summarizes and analyzes civil and military standards applicable to CRFS for transport 
category airplanes. The impact of the new “Mega- AC” system is discussed. 

Conclusions of the study are presented in section 9. 

Recommendations resulting from the study are presented in section 10. 

References used in the study are presented in section 1 1 . 

A bibliography of related literature is presented in section 12. 


2. REVIEW OF POSTCRASH FIRE RESEARCH. 


2.1 BACKGROUND . 

Early efforts of the CAA (FAA) to combat aviation fires involved efforts to reduce in-flight 
engine fires. With the advent of turbine engines and pod-mounts below the wing, in-flight fire 
risk declined. This led to a switch in emphasis to postcrash fires, although some work continued 
on flight fire hazards [1]. The postcrash fire effort was precipitated by statistical studies of 
airplane accidents which showed that those accidents with postcrash fires had a much higher 
fatality rate than those without fires. For instance, the 1946 statistics on U.S. air carrier accidents 
showed that fire followed 13 percent of all accidents and that approximately 30 percent of the 
passengers involved in those accidents were killed as a result of the fire. Two to three times as 
many people were being killed in fire accidents as in non- fire accidents [2] . 

At the Aircraft Fire Protection Conference in June 1946, the CAA’s Technical Development 
Center proposed two test programs to determine the causes of failure of existing fuel tanks 
subjected to crash loads [3]. One program, which involved impact and deceleration testing of 
existing wing fuel tank structures, was funded and the initial test program was completed in 
1950. Additional programs followed, including a series of full-scale aircraft crash tests 
conducted by NACA (NASA) to better define the postcrash fire problem and develop methods of 
reducing or eliminating these fires. 

The increasing use of rotary-wing aircraft in military and civilian operations prompted similar 
studies to determine the hazard of postcrash fires in accidents with helicopters. A 1961 study of 
major accidents involving both civilian and military helicopters showed that, although only 8.7 
percent of the accidents resulted in fire, 60.4 percent of all the fatalities occurred in those fire 
accidents [4]. Similar results were found in an analysis of U.S. Army helicopter accidents from 
July 1957 to June 1960. Seven percent of the 579 accidents examined resulted in postcrash fires, 
but 63 percent of the fatalities occurred in those postcrash fire accidents [5]. The study also 
found that 78.5 percent of the postcrash fires could be attributed to ruptured fuel cells and/or fuel 
lines. 

In September 1959, the U.S. Army Transportation Command funded a 1-year contract with the 
Flight Safety Foundation to conduct research generally in fields related to Army Aviation Safety, 
with particular reference to crash injury and crashworthiness programs. The work was to be 
conducted largely by Aviation Crash Injury Research (AvCIR), a division of the Foundation in 
Phoenix, Arizona. Thus began a collaboration that was to continue for over 10 years and would 
result, among other crashworthy improvements, in the development, design, and installation of 
crash-resistant fuel systems in the entire fleet of U.S. Army helicopters. 

Concurrent with the development effort for helicopter CRFS by AvCIR and the U.S. Army, the 
FAA was continuing research into the crash resistance of transport aircraft fuel systems. In the 
1970s, a 10-year program was begun, in cooperation with NASA, to improve the 
crashworthiness of general aviation aircraft. Following this effort, the FAA again turned its 
attention to improving the crash resistance of transport airplane fuel systems - an effort that 
continues to this day. 



The history of this overall fire research effort, which has spanned more than 50 years, is 
summarized in some detail in the remainder of this section. The abbreviated history outlined in 
figure 2-1 may assist the reader in relating the various projects to time and to each other. 

2.2 DEFINING THE POSTCRASH FIRE PROBLEM . 

2.2.1 Airplane Crash Testing . 

Studies to define the causes of aircraft postcrash fires and the specific hazards such fires pose to 
the occupants began in 1924 during crash tests of United States Army DH-4 aircraft used to carry 
mail. By removing ignition sources from areas of anticipated fuel spillage, crash fires were 
prevented. While these and other efforts, such as the selective placement of fuel tanks, offered 
some help in reducing the postcrash fire problem, the first major scientific effort to address the 
problem in detail began in the late 1940s with several test programs conducted by the CAA and 
NACA in conjunction with the U.S. Air Force. 

NACA proposed in 1948 that full-scale crash tests be conducted to determine if the use of low- 
volatility fuel offers significant safety benefits over gasoline and to obtain further information on 
the origin and propagation of fire during crashes [2], Subsequently a series of 17 full-scale crash 
tests was conducted using low-wing (C-46) and high-wing (C-82) twin-engine cargo transport 
airplanes [6], All the airplanes had reciprocating engines and most tests used gasoline but some 
used low-volatility fuel. The tests were structured to simulate a takeoff accident in which the 
plane fails to become airborne. The airplanes were accelerated along a guide rail under their 
own power, and then released just before impacting an earthen barrier, which tore off the landing 
gear and displaced the engines and nacelles. The airplanes then struck embedded poles designed 
to rupture the wing fuel tanks and the airplanes slid along the ground until they stopped. Impact 
speeds were 80 to 105 mph. 

These pioneering tests showed that fuel spilled in liquid form from broken fuel lines and tanks 
formed a fuel mist around the plane while the plane was in motion. Depending on the nature of 
the aircraft deceleration phase, the fuel mist could be projected ahead of the slowing aircraft, it 
could surround the slowing aircraft, or the fuel mist could trail behind. Fuel spillage from the 
leading edge of the wing could attain appreciable spanwise spread as a mist forward of the 
leading edge. A spilled mist fuel usually surrounded the aircraft wreckage after it came to rest. 
The mist generally dissipated within 2 to 1 7 seconds after the plane stopped, depending on wind 
speed. Ignition of the mist occurred in as little as 0.6 second after impact. Flames spread rapidly 
through the mist (as fast as 45 ft/sec) as the flame front velocity was accelerated by the 
expanding burning mass of fuel and air. The tests also showed that the use of low-volatility fuel 
did not prevent ignition or fire. 
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FIGURE 2-1. ABBREVIATED HISTORY OF AIRCRAFT FIRE RESEARCH 














Ignition sources determined during the tests were: 

a. hot surfaces (e.g., exhaust system, heat exchangers, etc.) 

b. friction sparks from abraded airplane metals 

c. engine - exhaust flames 

d. engine induction system flames 

e. electric arcs, electrically heated wiring, and lamp filaments 

f. flames from burning hydraulic fluid, engine oil, and alcohol 

g. electrostatic sparks 

The work on the origin of crash fires was extended to jet aircraft soon thereafter. The ignition 
hazards of electrical and friction sparks and air heaters were the same as for piston aircraft. New 
elements were the jet engines and jet fuels. This effort began with two full-scale crash tests; one 
utilizing a C-82 with pylon-mounted jet engines underneath the wings and one using an F-84 
with its jet engine located within the fuselage [7], Test conditions were similar to those 
described above. Both crashes resulted in fires when fuel mist ingested into the engines 
produced flames at the engine inlet and tailpipe, igniting misted fuel spilled from the wings. The 
fuel was ignited inside the engine by combustion flame or hot-metal surfaces. 

A crash fire protection system was designed that disconnected the electrical system, closed the 
fuel shutoff valve, and sprayed water on hot engine parts. All were activated by a crash- 
activated switch. There were no fires with this system installed during six full-scale crash tests. 

NACA had also advocated in 1948 that efforts be continued on fuel system configurations and 
construction methods to contain fuel during a crash. An extensive test series was being 
conducted at this time by the CAA to determine the effectiveness of fixed-wing integral tanks 
and conventional bladder-cell tanks in containing fuel during crashes [8], The test program 
consisted of three basic test series of wing sections, including fuel tanks. These tests were (1) 
deceleration; (2) impact; and (3) deformation. The first two test series were conducted with the 
wing tanks mounted on a carriage accelerated down a test track; the first with the wing tank 
rigidly attached to the carriage and the second with the wing tank catapulted from the carriage 
into a flat sandbag surface. The deformation tests consisted of torsional and bending tests 
conducted in a test rig. 

The results of these tests showed that, although integral tanks could withstand over 20-G 

acceleration in the absence of a direct impact (resulting in fluid pressures of 30 to 40 psi), they 

had very low resistance to direct impacts. The tests also showed that the current bladder cells -\ 

had low strength and inadequate stretching capability (low elongation). Thus, the cell walls 

could not withstand the dynamic pressure loads when support of the surrounding structure was 

lost. 

The CAA investigators concluded that no current fuel tank had any crash-resistant characteristics 
to any appreciable degree and no particular type of tank was better. They also concluded that 
any type of wing tank was safer if (1) it was located outboard in the wing where the wing was 
not likely to break off; (2) a center spar was used to separate tanks fore and aft; (3) the wing was 
protected from ground contact by low nacelles or other structure; (4) heavy front spars and 
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leading-edge structures were incorporated into the wing; and (5) landing gear loads were not 
applied directly to the tank structure. 

The first two full-scale crash tests of commercial transport airplanes were conducted for the FAA 
by Aviation Safety Engineering and Research (AvSER, formerly AvCIR) in 1964 [9 and 10]. 
The test program was designed to simulate typical conditions during survivable takeoff and 
landing accidents and to collect data on crash loads, accelerations, and fuel containment. The 
airplanes (a DC-7 and a Lockheed Constellation, Model 1649) were guided into a series of crash 
barriers using a monorail nose-gear guidance system. The aircraft were accelerated under their 
own power by remote control. Initial impact was against low barriers, which removed the 
landing gear, allowing the aircraft to become airborne (see figure 2-2). Subsequently the left 
wing impacted an earthen mound shaped to produce a simulated wing-low accident while the 
right wing struck vertical telephone poles simulating trees. The fuselage then struck an upward 
slope (8° for the DC-7, 6° for the Constellation), becoming airborne again until striking a 20° 
slope to simulate a steeper impact angle. The aircraft then slid to a stop. Impact speeds were 
139 kts for the DC-7 and 1 12 kts for the Constellation. 
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FIGURE 2-2. PLAN VIEW OF TEST SITE FOR DC-7 AND CONSTELLATION 
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The DC-7 had both integral and bladder fuel tanks while the Constellation had only integral 
tanks. One tank in each wing was filled with dyed gelled water while the rest of the tanks were 
filled with dyed liquid water. Only the minimal amount of fuel necessary to conduct the test was 
onboard in an auxiliary tank mounted in a location safe from impact. Even so, fuel and oil lines 
were ruptured when the engines were torn free in the DC-7 crash. A heavy mist of fuel and oil 
ignited and burned for several seconds, illustrating the ignition potential of the engine and the 
ease of ignition of fuel mists. 

The wings of both aircraft suffered extensive damage, especially the right wings from the 
localized impacts of the poles. Both wings of the DC-7 broke at the wing roots and the outer 
panel of the right wing was sheared off. The left wing of the Constellation was partially 
separated at the wing root and the outer panel of the right wing was sheared off. In addition, the 
right wing of the Constellation was partially separated between the engine nacelles by the pole 
impact, finally separating completely as the aircraft slid along the ground. All of the fuel tanks 
in both tests were damaged and, in some cases involving pole impacts, destroyed. Massive 
spillage occurred from the tanks. Spilled fuel (fBO) and mist surrounded the aircraft to a large 
extent, both while in motion and after coming to rest. (Figure 2-3 illustrates the spillage pattern 
of the Constellation.) 



4 Right outboard wing tank (water) 

FIGURE 2-3. VISIBLE FUEL SPILLAGE OCCURRING 2.24 seconds AFTER 
CONSTELLATION IMPACT WITH MAIN GEAR BARRIERS 
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The gelled water was expelled immediately from both the DC-7 and Constellation right wing 
fuel tanks which were subjected to direct pole impacts. However, it took 2 hours for the gelled 
fuel to drain from the left wing tank of the Constellation, which suffered spanwise cracks in the 
bottom of the tank and a tom top. 

The behavior of the two aircraft structures during the tests were quite different. The DC-7 
structure was of the older design technique using relatively ductile skin supported by longerons, 
etc. The Constellation used a newer stressed skin design incorporating high-strength, relatively 
low elongation, aluminum similar to today’s aircraft. In addition, the Constellation Model 1649 
contained a totally new wing of increased span incorporating huge chemically milled, machined 
skins. The brittle Constellation stmcture broke into many small, jagged pieces of metal on 
impact, as contrasted to the DC-7 stmcture, which tended to crumple, crush, and tear. The 
greater hazard of jagged, broken stmcture (versus crumpled stmcture) to the survival of 
nonintegral fuel tanks is an area of concern in transport airplanes. 

Even with the differences in aircraft stmcture, these tests resulted in very similar mechanisms 
and patterns of fuel spillage as occurred in the earlier tests of smaller and older airplanes. These 
common patterns allow the construction of a general model of fuel system damage, spillage, and 
mist formation that occurs in typical large transport airplane accident scenarios. Thus, it should 
be possible to derive solutions to the postcrash fire problem that are universally applicable to 
large transport airplanes, although implementation into specific airplanes would necessitate 
varying detailed designs. 

2.2.2 Helicopter Crash Testing . 

Although the FAA had conducted six helicopter drop tests by 1959, these tests were designed 
primarily to measure stmctural load factors during crashes [11]. The crash tests conducted by 
AvCIR for the U.S. Army in the early 1960s were the first designed to determine the behavior of 
helicopter fuel systems during crashes. The first of what would eventually be over 40 crash tests 
was conducted in October 1960 [12]. This test consisted of a moving crane drop of a twin-rotor, 
light-cargo helicopter with test conditions simulating severe but survivable conditions (forward 
velocity of 30 mph, 30-foot drop height). High-speed on-board and ground-based cameras 
documented the test and allowed visual analysis of events occurring during the crash. The test 
was designed to measure stmctural loads, seat restraint and test dummy loads, and to determine 
the performance of the regular fuel system and an experimental range extension fuel tank carried 
in the right-hand seat. The seats collapsed during the impact and the range extension fuel tank 
was mptured in several places, resulting in large amounts of fuel spillage in and around the 
helicopter. The regular fuel system was not mptured. More importantly, the test proved that this 
was a satisfactory and inexpensive method for crash testing. 

Four more helicopter crash tests were conducted in the following year, all using the same test 
methodology that was used in the first test [4], The basic purpose of these tests was to obtain 
acceleration and force data to define the survivable crash environment. This would, in turn, help 
the aircraft designer develop better components such as seats, restraint systems, and fuel systems. 

Meanwhile, in-depth investigations of U.S. Army helicopter accidents began in the 1950s and 
would extend through the 1960s. These numerous accident investigations, coupled with full- 



scale crash tests, were detailing some of the most common fuel system failures that occurred 
during helicopter crashes. These were 

a. Many helicopter fuel tanks were located low in the structure and/or very near the outer 
surface of the aircraft, subjecting them to severe loads. Additional loads could be added 
by heavy cargo and, in some cases, by the engine or transmission. These loads would 
cause the tanks to rupture during the crash. 

b. The tank would be punctured by jagged metal and broken components of the failing 
structure. When puncture coincided with the high-pressure loading of the tank 
experienced during the crash, the fuel tank wall would tear. This tear would progress 
rapidly away from the point of puncture. 

c. Fuel tank fittings would be tom from the tank wall as the structure moved relative to the 
tank. 

d. Fuel lines would be cut or tom apart if they were located in areas of displacing or failing 
structure. 

From this knowledge, a system was developed to allow evaluation of the crash survival potential 
of a fuel system even though no accident record was available for that aircraft. Four crash tests 
were conducted on OH-4A and OH-5A helicopters after they had been evaluated in flyable 
condition [13 and 14]. The fuel systems were re-evaluated after the crash tests and close 
correlations between the pre- and posttest evaluations occurred in every case. The authors 
concluded that a trained evaluator could reliably evaluate the crash survival potential of an 
aircraft fuel system in the absence of accident data and that reliable estimates could be made 
even during the design stages of a specific aircraft. This evaluation system has been refined over 
the years and is currently in use today (see section 7). 

2.2.3 The Postcrash Fire Environment . 

NACA was the first (in 1953) to investigate and quantify the postcrash fire environment and to 
determine available escape times based on this data [15]. The data were obtained from the full- 
scale airplane crash tests previously conducted and from supplemental bums of aircraft hulks. It 
included measurements of the radiant heat, ambient air temperatures, and concentrations of 
carbon monoxide (CO). Escape times were calculated from the measured data and known 
human tolerance levels. (Escape time from thermal injury was based on the skin temperature 
which resulted in severe pain and second degree burning.) Escape times based on thermal injury 
varied from 50 to 300 seconds, depending on the position of the occupant in relation to the fire, 
size of the fire, and environmental conditions at the crash site. It was found that fuel volatility 
did not affect escape times when fuel mists occurred, as happens during most aircraft crashes. 
Escape time based on CO concentration was longer than for thermal injury, although the times 
did not differ greatly. 

The NACA investigation also studied the effects of insulation on fuselage skin bum through 
times. Two identical enclosures, one insulated with 2 in. of glass wool held in place with a thin 
insulation and fabric pad and one uninsulated, were subjected to ground fuel fires. The study 
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found that the temperatures in the insulated enclosure remained below those in the uninsulated 
enclosure initially, but, after 7 1/2 minutes, the insulated enclosure burned through and then 
temperatures increased rapidly. The uninsulated enclosure did not bum through until 12 minutes 
after the fire started. The investigators surmised that the insulation prevented the reradiation of 
heat from the opposite skin surface, as occurs with uninsulated skin. However, the validity of 
this data to current aircraft with improved interior materials and different types of insulation 
must be questioned. 

Subsequent studies determined that 0.03 5 -inch-thick fuselage skin burned through in 63 sec [16]. 
The temperature inside the cabin did not rise until bum through occurred. Interior materials were 
the most important factor affecting the fire hazard once bum through occurred or flames entered 
through structural openings. Gases generated from burning materials can lead to a flash fire 
(flashover) in only a few minutes. In addition to toxic gases, large quantities of smoke are 
generated from burning fuel, oil, hydraulic fluid, and interior materials. This smoke obscures 
vision and makes breathing difficult. 

More recent bum tests (1989) of contemporary transport airplane structures with newer, more 
fire-resistant interior materials showed that skin bum through still occurred approximately 60 sec 
after ignition of an exterior fuel fire next to the fuselage [17]. However, the fiberglass insulation 
and honeycomb composite sidewall panels acted as a fire barrier behind the skin after the skin 
melted away. Smoke obscuration inside the cabin occurred much earlier than significant flame 
penetration. (It should be noted that the test conditions assured that the insulation and panels 
remained intact. Any break in their structural integrity would alter these results.) The 
researchers also found that early threats to passengers when fire enters the fuselage through 
openings were (1) elevated temperatures and (2) reduced visibility from smoke, before burning 
interior materials became a factor. As determined in earlier tests, factors that greatly affected 
flame entry were wind conditions, door opening configuration, and fuselage orientation. 

The contribution of the interior materials to the fire environment was determined by subjecting 
an intact fuselage to an external fuel fire adjacent to an opening in the fuselage. Wind conditions 
were quiescent so the survivability was controlled by the interior materials and not burning fuel. 
Survivability was dominated by cabin flashover, which occurred at about 210 seconds after 
ignition. Prior to flashover, seat-top temperature was near ambient. However, the researchers 
reported that visibility was reduced by smoke before any apparent impairment to the occupants 
from elevated temperature or toxic gases. 

The above test results were corroborated during a test conducted by the FAA in 1996 to 
determine the bum through characteristics of a transport airplane exposed to a large pool fire 
upwind of the fuselage [18], The design mode for the test was the B-737 ground accident in 
August 1985 in Manchester, England, which resulted in 55 fire fatalities. A Convair 880 was 
modified so it was similar inside to the B-737 in configuration and interior materials. The test 
had key elements of the Manchester accident, including fire size and location, relative wind 
direction and velocity, and automatically sequenced door and escape hatch openings. 
Measurements were taken throughout the cabin of temperature, smoke density, and O 2 , CO, and 
CO 2 concentrations. The test configuration is shown in figure 2-4. 



FIGURE 2-4. TEST CONFIGURATION AND SENSOR LOCATIONS (BY STATION 

NUMBER) FOR FAA BURN TEST 

After ignition of the pooled fuel, a large amount of flame blew over the rear part of the fuselage. 
The fire burned through the fuselage into the cabin 71 seconds after ignition, igniting a seat 75 
sec after that (146 sec after ignition). Fire also penetrated the empennage crawl through 70 sec 
after ignition. The mode of fire penetration was direct melting of the skin and burning of 
insulation and interior panels. The interior materials, once ignited, easily supported a self- 
sustaining fire. Thick black smoke filled the rear of the cabin within two minutes. As the fire 
intensity increased, the smoke moved forward, appearing in the first class cabin in slightly less 
than 3 minutes. Temperatures depended on the distance from the area of bum through and 
resultant interior fire. A series of three flash fires occurred in the main cabin, the first one 235 
sec after ignition, causing a rapid temperature rise and decrease in oxygen. Passengers in this 
part of the cabin would have been subjected to nonsurvivable conditions at this time. 

Although the incorporation of greatly improved fire-resistant interior materials affords increased 
safety and lengthened escape times during some fire scenarios, the benefits are not universal. 
Fuel flammability can be the overriding hazard in the case of large quantities of fuel spillage 
and/or when openings in the fuselage allow flames and hot gases and smoke from the fuel fire to 
enter the fuselage [19]. In this case, the upper layer of the cabin can quickly become 
contaminated with degradation products from the fuel fire, leading to flashover. The heat and 
fire spread characteristics of a fuel fire can also cause materials with outstanding fire resistance 
to bum readily. For these reasons, the National Safety Council concluded that the reduction of 
the fire hazard of fuel is critical in improving survivability in postcrash fires. 
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2.3 DEVELOPMENT OF THE CRASH-RESISTANT FUEL SYSTEM fCRFS) . 


2.3.1 Early Developments . 

Following the disappointing results of the FAA’s wing fuel tank tests conducted in the late 
1940s, the researchers recommended that any type of tank was safer if it was protected by 
heavier structure (e.g., the front spar) and located away from areas of structure prone to 
pronounced displacement during a crash (e.g., wing roots and landing gear) [8], They also 
proposed the development of high-strength and energy-absorbing properties in flexible bladders 
as offering the most promising solution. They recommended the use of flexible fuel lines and 
breakaway self-sealing couplings at the firewall to prevent fuel line failure and the use of inertia- 
operated shut-off valves at the fuel tank outlets. 

The FAA then embarked on a 10-year program, from 1950 to 1960, to develop improved crash- 
resistant fuel tanks and self-sealing breakaway valves for use in aircraft fuel systems. Accident 
reports and accident investigation data were studied to determine impact attitudes and load 
factors in severe but survivable accidents for both fixed- and rotary-wing aircraft. Based on this 
data and the data obtained during the previous wing tank tests, a resultant load factor of 35 G’s 
was recommended for fuel tank design in fixed-wing aircraft since this load factor was 
considered likely under severe but survivable crash conditions [11], It was also proposed that 
crash-resistant fuel cells be equipped with accessories and components which would not tear the 
cell and which could seal the fuel inside the cell in the event of appreciable cell movement. 

Six helicopter drop tests were conducted in the late 1950s to furnish additional data for rotary 
wing aircraft [11], The helicopters were dropped from a height of 26 feet, resulting in an impact 
velocity of 41 ft/sec. Accelerometers measured structural and dummy loads. The tests resulted 
in an average structural load factor of 32 G’s. The instrumented dummies indicated the impacts 
were survivable, though injuries could be expected. Thus, the investigators concluded that a load 
factor of 35 G’s was also justified for helicopter fuel systems. 

Three of the drop tests were of helicopters with the fuel tank located in the bottom of the 
structure underneath the two rear seats. The conventional bladder fuel cell ruptured on impact 
and the fluid in the cell flooded the cabin interior. The two additional drop tests used self-sealing 
fuel cells made from material possessing a higher tensile strength. These cells did not rupture. 
The FAA investigators concluded that, though previously thought to be impossible or at least 
impractical, it was feasible to design “squash-resistant” fuel tanks for helicopters. 

Meanwhile, in the mid-1950s, 5 different fuel cell materials, developed in a cooperative effort 
with the rubber manufacturers, were being tested [20], These materials were a composite, 
nonmetallic flexible construction made from elastomer-impregnated fabric arranged in layers or 
plies. Two types of tests were conducted: (1) strength and energy-absorbing properties of 

material samples were determined using a compressed-air gun and (2) impact tests were 
conducted of completed fuel cells mounted in two different simulated wing structures. The 
researchers found that the impact resistance varied linearly with the tensile strength and energy- 
absorbing properties of the material and was affected greatly by the fuel cell construction (e.g., 
diffusion barrier liners in the cell and reinforcement at vulnerable locations of the cell). 



A method for calculating the tensile strength of crash-resistant bladder cell materials was 
developed based on the wing impact tests. It was felt that the tanks should not rupture under 
loads sufficient to tear the wings from the fuselage. The tensile strength required was to be 
determined by using a compressed-air gun [21]. This entire effort ultimately resulted in the 
issuance of specification MIL-T-27422A for fuel tanks in 1961. [ Subsequent full-scale testing 
showed that tensile strength was not the main factor in determining the crash resistance of fuel 
cells and MIL-T-27422A was subsequently revised .] 

As the bladder cell program was nearing completion, the FAA began a program to develop 
crashworthy safety valves and accessories for the new tanks. This program arose from the 
recognition that the ability of the fuel cell to remain intact as it moved during a crash was 
influenced by the accessories attached to it. Therefore, crash-actuated shutoff valves were 
needed at all cell openings and breakaway attachments to aircraft structure were needed for all 
fuel cell components and fuel cell hangers. Guidance for development of shutoff valves and 
breakaway accessories was obtained from fuel cell fitting manufacturers, aircraft manufacturers, 
and fuel cell manufacturers at a conference sponsored by the FAA’s William J. Hughes 
Technical Center. The Center then designed, fabricated, and tested shutoff valves and frangible 
attachments to be used with the new crash-resistant fuel cells [22], The results of 91 dynamic 
tests provided enough design and performance data to derive specification requirements for 
prototype valves and accessories. 

In 1958, contracts were awarded to aircraft valve manufacturers for prototype breakaway valves 
and accessories. Valve assemblies were received the following February and tested. As a result 
of this program, the U.S. Air Force prepared a specification for self-sealing breakaway valves 
(MIL-V-27373), which was issued in 1960. 

The efforts of this early development program led to the issuance of criteria for the design and 
installation of crash-resistant fuselage fuel tanks in 1958 [23]. Formulas were given for 
calculating tensile strength of material necessary for particular tank configurations. Although 
later testing would show that tensile strength alone was insufficient for crash-resistant fuel cell 
materials, other criteria presented are still the basis for much of today’s CRFS design. These are: 

a. Fuel tanks should be located so that they are 

• not likely to undergo scraping action with the ground 

• not in front of the forward plane of the front wing spar 

• not under or directly in front of heavy masses 

• as far as possible from occupants and engines 

b. Landing gear structure should not be attached to fuel cell supporting structure. 

c. Fuel cell supporting structure and components in the immediate vicinity of the tank 
should be designed or arranged to minimize the possibility of puncturing or tearing the 
cell. 

d. Flexible fuel and vent lines should be used to provide as much movement as possible 
during crash conditions. 
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In addition, although much design and testing would still have to be done, the following criteria 
were included: 

a. Shutoff valves should be located in the fuel cell fuel and vent line outlets, which would 
automatically close in the event of any appreciable relative movement of the cell with 
respect to another cell or surrounding structure. 

b. Attachments holding the cell to surrounding structure should be designed so the cell can 
pull loose from the structure without tearing the cell wall. 

2.3.2 Helicopter CRFS Development . 

The first extensive testing of the new crash-resistant fuel tanks occurred as a part of the U.S. 
Army-funded research conducted at AvSER. Several fuel tank manufacturers had already 
qualified fuel cells to MIL-T-27422A. Several of these cells were installed in two CH-21 
helicopters, which were crash tested in October 1963 [24]. The first test helicopter was flown 
and crashed by a radio link remote control system. Impact velocities were 38.5 ft/sec 
longitudinal and 1 1 ft/sec vertical. The second helicopter was dropped from a mobile crane, 
impacting with a longitudinal velocity of 38.6 ft/sec and a vertical velocity of 36.8 ft/sec. The 
tanks were punctured in the low-limit crash and failed catastrophically in the more severe crash. 
These tests clearly showed that the current crash-resistant tanks were not adequate. The vertical 
loading of the under-floor tanks had been underestimated. Also, puncture and tearing of the tank 
material from jagged metal and the pulling out of fuel tank fittings had not been addressed in 
MIL-T-27422A. It was apparent that resistance to puncture and tear propagation were equally as 
important as the material’s tensile strength. 

A cooperative effort was undertaken with several fuel cell manufacturers to develop and test 
improved tank materials [24 and 25]. A large number of materials were screened and the most 
promising were tested for penetration and tear resistance using a chisel dropped onto a material 
sample and a pull test of material having a slit in it, respectively. Full-scale tanks for crash 
testing were then constructed from the most promising of these materials. These tanks, as well 
as typical aluminum tanks, standard aircraft tanks and MIL-T-27422A tanks were tested in three 
fixed-wing and three helicopter crash tests conducted in 1964 and 1965. The fixed-wing (C-45) 
aircraft, containing two fuel tanks in each wing, were accelerated along a monorail into a 35- 
degree barrier on the left and embedded poles on the right so that both wings suffered extensive 
damage. The helicopters (CH-34 and CH-21) were dropped from a mobile crane. The helicopter 
fuel tanks were located under the floor with rocks mounted beneath the fuselage or heavy cargo 
above the tanks. All were severe but survivable crashes. 

The test results are shown in table 2-1. All of the tanks tested exhibited massive failures except 
for those made by Goodyear (“tough wall” and “fuzzy wall”), which showed good impact 
resistance. The “tough wall” material consisted of three to four plies of nylon cloth oriented at 
various angles and bonded together with a resin. The “fuzzy wall” tanks were made from a 3/8- 
inch-thick nylon felt pad with a variety of inner membrane sealing films or layers. The 
investigators concluded that fuel tanks constructed of materials such as those made by Goodyear 
could provide excellent crash resistance at a reasonable weight. They also concluded that MIL- 
T-27422A was inadequate and should be revised to include provisions and tests for impact, 
penetration, tear resistance, and fitting retention. 
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TABLE 2-1. SUMMARY OF AvSER TEST RESULTS — FULL-SCALE CRASH TESTS 



Location 


Wing 

Fuselage 

Under floor 

Tank Type 

No. 

Tests 

Pole Impact 

No. 

Tests 

Wing-Tip 

Impact 

No. 

Tests 


No. 

Tests 

No Cargo 

No. 

Tests 

1,000-lb Cargo 

Pliocell 

0 

- 

0 

- 

3 

3 Failed* ** *** **** 

3 

3 Failed 

0 

- 

Crash Resistant*** 

0 

- 

0 

- 

2 

2 Failed 

0 

- 

0 

- 

Aluminum 

2 

2 Failed 

2 

1 Failed 

0 

- 

1 

1 Failed 

0 

- 

Exp. Tank (A)** 

0 

- 

1 

No Failure 

0 

- 

0 

- 

1 

Failed 

Exp. Tank (B)** 

0 

- 

0 

- 

0 

- 

0 

- 

1 

Failed 

Exp. Tank (C)** 

0 

- 

0 

- 

0 

- 

0 

- 

1 

Failed 

Self-Sealing 

0 

- 

0 

- 

0 

- 

4 

4 Failed 

0 

- 

Net Tank 

0 

- 

0 

- 

0 

- 

0 

- 

1 

Failed***** 

Tough Wall Hollow 

2 j 

No Failure* 

2 

No Failure 

1 

1 Failed 

1 

No Failure 

1 

Failed 

Tough Walk Honeycomb j 

1 

No Failure* 

1 

No Failure 

0 

- 

2 

! 

No Failure* 

1 

No Failure 

Fuzzy Wall 

1 

No Failure 

! 

0 

- 

0 

- 

0 

- 

1 

No Failure 


* Minor Seepage - One Tank 

** Firestone Experimental Tanks 

*** MIL Specification T272422A 

**** Previous CH-21 Tests by AvSER 

***** Spillage Approximately 1 gal./min. 


Development of new fuel tank materials continued. Goodyear soon developed two new 
materials known as ARM-018 and ARM-021 [24], Both were laminates using woven ballistic 
nylon cloth impregnated with a urethane elastomer. The typical crash-resistant cell then in use 
had a tear strength only 9 percent that of ARM-02 1 . 

In 1966, Goodyear Aerospace, The Aeroquip Corporation, E. B. Wiggins Corporation, and 
AvSER, working together, began a comprehensive program to improve the crash resistance of 
U.S. Army helicopters and to extend the crash resistance of the new, improved fuel cells to the 
entire fuel system. The fuel systems of four current U.S. Army helicopters (UH-1B, UH-1D, 
CH-47, OH-6A) were analyzed and evaluated using design drawings, inspections of as-built 
aircraft, and available accident records [26]. Components analyzed included fuel cells (location, 
shape, and installation), fuel cell components, and their attachments (drains, vents, filler necks, 
boost pumps, etc.) and the fuel transfer system (fuel cell interconnects, fuel lines, fuel line 
fittings, etc.). The electrical systems and other potential ignition sources also were evaluated. 
Recommendations were made for improving the crash resistance of all four helicopter fuel 
systems. These recommendations included, among others, the use of the new crash-resistant fuel 
tanks, frangible attachments for all fuel tank components which had to be attached to the aircraft 
structure, flexible fuel lines and stronger fuel line fittings, and self-sealing breakaway valves at 
all tank outlets and at high-risk locations in the fuel lines. 

In addition to the fuel system analyses, a comprehensive testing program was conducted on 
currently available aircraft fuel lines and fittings. Static tension and shear tests were conducted 
on both aluminum tubing and flexible, steel-braid-covered hose. All common sizes of AN fuel 
line fittings (straight and elbow) were tested in conjunction with the hoses and tubing. It was 
found that the aluminum tubing and the smaller aluminum fittings were unsatisfactory for crash- 
resistant systems. Although the fittings failed before the hose failed or pulled out, the aluminum 
tubing failed or pulled out before the fitting failed. It was also determined that the hose 
assemblies had elongations three to four times that of the tubing assemblies. 

Meanwhile, prototype frangible attachments for fuel cell components were fabricated and 
subjected to extensive testing [26], Results showed that plastic inserts in the metal attachment 
fittings could be readily developed for any application. 

Since no self-sealing breakaway valves were commercially available, currently used quick- 
disconnect valves were modified for use in tank outlets and in-line applications. These valves 
underwent an extensive series of dynamic tests and performed well under a wide range of 
conditions. This effort showed that a high degree of protection was possible with this type of 
valve and that the development of specifically designed self-sealing valves was quite feasible. 
The investigators also determined that MIL-V-27393A for self-sealing breakaway valves was 
inappropriate because it was too specific and restrictive in design. This specification has since 
been canceled and replaced by SAE ARP 1616A. 

The first crash test of a complete crash-resistant fuel system was conducted by AvSER early in 
1968 [27]. A UH-1A helicopter was equipped with crash-resistant fuel, oil and electrical 
systems. The system included (1) special crash-resistant fuel tanks and a felt-covered oil tank, 
(2) flexible fuel and oil lines in areas where rigid metal lines characteristically failed, and 



(3) self-sealing breakaway valves and fuel and oil line disconnects at strategic locations to allow 
for relative displacement of aircraft components. A diagram of the crash-resistant fuel system is 
shown in figure 2-5. The self- sealing breakaway valves in the fuel lines were modified quick- 
disconnect valves. The breakaway valves installed in the tanks at the aft crossover tube outlets 
were prototype valves made to safely separate by actually fracturing portions of the valve when 
crash forces were great enough, allowing each side of the valve to close. These “one shot” 
valves were made by the two valve manufacturers to meet AvSER specifications. All of the 
individual crash-resistant fuel system components had been extensively tested beforehand using 
both static and dynamic tests. 



FIGURE 2-5. UH-1A CRASH-RESISTANT FUEL SYSTEM 
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The helicopter was remotely flown to impact with a longitudinal velocity of 81 ft/sec and a 
vertical velocity of 23 ft/sec. The impact angle was 15.5 degrees. All of the systems functioned 
satisfactorily and there was no fuel or oil spillage. However, the vertical loading during impact 
was insufficient to activate all of the fuel system crash-resistant components. A follow-on test 
was conducted by dropping the fuselage section containing the fuel system onto several vertical 
railroad ties. The tie beneath the left cell impacted the boost pump, driving it up into the fuel cell 
and pulling the mounting out of the cell by shearing the tank wall at the bolt holes. The right cell 
was also severely impacted on the bottom but did not rupture. The self-sealing quick- 
disconnects used in the forward and aft crossover tube connections functioned properly, 
disconnecting and sealing the tank outlets. The fact that the conventionally mounted pump 
fitting sheared the tank wall at the bolt holes clearly indicated that new, 100-percent retention 
designs must be used. 

t 

2.3.3 Implementation of CRTS in Helicopters . 

The implementation of CRFS technology in the military proceeded along two complementary 
paths. One path was the preparation of design guides and specifications incorporating the new 
technology and the other was the actual design and installation of CRJFSs in U.S. Army 
helicopters. 

In 1965 the U.S. Army initiated, under its contract with AvSER, a project to consolidate the 
knowledge and design criteria published in the previous AvSER reports into one report. This 
report was to summarize the state-of-the-art in crashworthy technology and include pertinent 
work conducted by other agencies as well as that done by AvSER. This report was published in 
1967 as the Crash Survival Design Guide [28], The Design Guide, as it came to be known, 
included all aspects of crashworthiness (aircraft crash survival impact conditions and design 
pulses, airframe crashworthiness, seat and restraint harness design criteria, occupant environment 
criteria, emergency escape provisions and postcrash fire safety). The section on postcrash fire 
safety was mostly devoted to the design of CRFS. Some design criteria were presented for 
ignition source control, such as de-energizing electrical sources, inerting hot surfaces, and 
shielding wires and electrical components. A brief discussion of the postcrash fire environment 
as related to human tolerance and escape times also was presented. 

The criteria for CRFS included a detailed analysis of MIL-T-27422A and showed why the 
cut- and tear-resistance of the fuel tank material was vital to its survival during a crash. 
Properties of the new materials were presented along with those of then standard materials, as 
shown in figure 2-6. The areas under the curves in figure 2-6 denote the energies necessary to 
H * fail these materials. The new materials absorbed eight to twelve times more energy than the 

* MIL-T-27422A material. 

The Design Guide also stressed the interaction of the fuel system components and aircraft 
structure during the crash. Since failure of the tank was often caused by the tearing of the tank 
wall around the attachments as the tank moved in relation to the surrounding structure, the use of 
frangible attachments and self-sealing breakaway valves was specified. Protected locations for 
fuel lines, extra length in the lines, and the use of flexible hose with a braided steel covering 
were recommended. 
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FIGURE 2-6. RESISTANCE TO TEAR FOR TANK MATERIALS 

The Design Guide was updated to include research completed by AvSER (now a division of 
Dynamic Science) and Goodyear through January 1969 [29], Major additions to the CRFS 
design criteria included examples of high-strength fuel tank metal insert retention methods and 
the requirement that the inserts have a retention strength of at least 80 percent of the tank wall 
strength. Drawings showing different applications of self-sealing valves also were included 
along with the requirement that such valves, as well as all frangible attachments, should separate 
at less than 50 percent of the load required to fail the attached component. In addition, the vent 
system design was expanded to prevent vent-line failure or spillage from a rollover. Minimum 
loads for fuel line fittings were also specified. 

Additional research and testing of fuel tanks resulted in the formulation and publication of MIL- 
T-274228 in February 1970 [30], The specification was completely revised and included new 
requirements to ensure the fuel tanks would, indeed, be crash resistant. In addition to laboratory 
tests of the fuel tank material to measure the puncture and tear resistance, tests were also 
required to assure satisfactory tank fitting retention strength. Perhaps the most important change 
was the inclusion of dynamic testing of the completely configured fuel tank by dropping it, filled 
with water, onto a flat surface from a height of 65 feet. 

The research, design, and testing involved for the development of the UH-1D/H helicopter CRFS 
(begun in 1968) yielded much more knowledge about design criteria for CRFS and their 
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components. Accordingly, the Design Guide was revised again in 1971 [31]. Extensive 
additions were added in all areas, including that section devoted to CRFS design. Requirements 
from MIL-T-27422B were added, including the 65-foot drop test of the fuel tank with no 
leakage. Test methodology was included to assure tank fitting retention strength of 80 percent of 
tank wall strength. Requirements for the separation loads of frangible attachments and self- 
sealing breakaway valves specified that the attachments and valves must meet all operational 
requirements but should separate at 25 to 50 percent of the load required to fail the attached 
system or component. Methods of analyzing and calculating the force in the most likely 
direction of occurrence during impact were presented. Criteria for the self-sealing valves stated 
that the valves should be specifically designed for a “one shot” emergency breakaway function. 
Additionally, minimum loads were required for fuel lines and their fittings and test methods were 
specified. This edition of the Design Guide was the basis for the criteria contained in MIL-STD- 
1290 released in January 1974 [32]. The Design Guide has since been revised and expanded 
twice as more knowledge has become available in all areas of crashworthiness. The latest 
revision was published in 1989. 

In 1968, the U.S. Army committed itself to markedly reducing postcrash fires in survivable 
helicopter accidents. Dynamic Science thus began a program for the U.S. Army to integrate a 
CRFS into the UH-1D/H helicopter manufactured by Bell Helicopter Company [33 and 34], The 
effort began by studying UH-1D and related accident cases to determine problem areas. The fuel 
system also was evaluated by the previously developed rating system (which had been expanded 
to include a more detailed process) to determine the overall fire hazard attributable to specific 
fuel system components. Crashed but intact hulls provided data for dimensions, possible 
interferences, and general system layout. As work progressed, a close liaison was maintained 
with the Bell Helicopter engineers and component suppliers. The design used many off-the-shelf 
items, but some items (which were only laboratory specimens at the beginning) had to be 
designed and built by various suppliers, then tested for operational and crashworthy 
acceptability. Almost 700 static and dynamic tests were conducted to assess the crash 
effectiveness of the various components in the fuel system. 

The UH-1D/H CRFS is illustrated in figure 2-7. The CRFS consisted of five interconnected 
MIL-T-27422B fuel tanks and tank outlets; self-sealing breakaway valves at the most vulnerable 
tank outlets; flexible steel-braid-covered hose with in-line breakaway valves at probable failure 
points; and frangible connectors at tank-to-structure interfaces (tank components and hangers). 
Three full-scale crash tests were conducted with helicopters containing the CRFS; one vertical 
drop test and two tests by guiding the helicopter down an inclined cable, all onto irregular terrain 
consisting of several large rocks and a stump. The fuel system generally performed as designed 
with only a few components allowing some leakage. The fuel tanks did not fail at all. The 
UH-1D/H CRFS was judged to be highly resistant to failure in survivable accidents. 

In April 1970, with the component leakage problem resolved, the first UH-1H helicopter with a 
CRFS came off the production line and all subsequent production helicopters were equipped 
with the CRFS. The manufacturers of the other military helicopters, i.e., Boeing, Sikorsky, 
Hughes, and Bell, started designing crash-resistant fuel systems for their helicopters using 
consulting input from the AvSER group of Dynamic Science and past AvSER employees who 


had joined the Robertson Research Group at Arizona State University. An extensive retrofit 
program was also begun to equip already manufactured helicopters with a CRFS. 



FIGURE 2-7. UH-1D/H CRASH-RESISTANT FUEL SYSTEM 

A study conducted by the U.S. Army of helicopter accidents from 1970 through mid-1973 
showed that the CRFS performed remarkably well [35]. There were no thermal injuries or 
fatalities in any of those helicopters equipped with a CRFS. A later study of U.S. Army 
helicopter accidents from 1970 through 1976 corroborated the outstanding performance of the 
CRFS [36], Data from this study showed that the CRFS had reduced thermal injuries by 75 

percent and had eliminated thermal fatalities. The investigators concluded that the CRFS “ 

has been shown to be a highly successful and operationally effective mechanism.” 

In 1975, researchers who had been instrumental in developing the CRFS for military helicopters 
concluded that it would be a logical step to provide postcrash fire protection to the civilian 
aviation industry and that no new scientific breakthroughs would be necessary to do this [37], 
Shortly thereafter, at least one manufacturer was planning to incorporate some CRFS technology 
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into one of its civil helicopters [38]. This twin-engine, eight-passenger helicopter was first flight 
tested in 1976 and scheduled for delivery in 1979 (actual delivery started early in 1980). The 
helicopter contained four crash-resistant fuel cells — two in the sponson structures and two in the 
fuselage just aft of the passenger compartment. The attaching sponson fuel and vent lines 
incorporated self-sealing breakaway fittings at the junctures of the sponsons and fuselage. (The 
fuel cells, though not as crash resistant as MIL-T-27422B fuel cells, had passed a 50-foot drop 
test and were a marked improvement over the regular bladder cells.) 

By 1986, the Aerospace Industries Association of America (ALAA) had established a Helicopter 
Crashworthiness Project Group to determine if crash safety improvements were needed for future 
civil helicopters. This group concluded that “Energy attenuating seats with shoulder harnesses 
and a crash-resistant fuel system are significant crash safety improvements that can be made for 
future civil helicopters ....” [39]. They also called for lower crash-resistant requirements for the 
fuel system since they believed the civil survivable crash environment was not as severe as the 
military’s. They recommended that the test methods of MIL-T-27422B be used but with lower 
criteria, i.e., a drop height of 50 feet (56 ft/sec) with the fuel tank only 80 percent full of water. 
They also determined that the CRFS should tolerate displacement between components due to 
structural deformation during a crash and that stretchable hoses, extra length hoses, self-sealing 
breakaway valves and frangible fuel cell attachments might be needed. 

The criteria recommended by the Committee for crash-resistant fuel tanks in civil helicopters are 
shown inside the enclosed area of table 2-2. This table shows the range of fuel cell bladder 
material in use at the time. (Uniroyal and FPT are shown because their data was immediately 
available, but other manufacturers also made fuel cell materials in the same range.) Most civil 
helicopters flying then were using material similar to the standard bladder material shown on the 
left of table 2-2, but the author reported that nine models of civil helicopters did incorporate 
some degree of crash resistance in their fuel systems by 1986. 

Note: The fuel cell drop tests reported in table 2-2 did not include the surrounding aircraft 
structure. The low tear resistance and puncture resistance of some of the materials as 
compared to that of the MIL-T-27422B material (shown on the right of table 2-2) will 
compromise the integrity of the fuel cell during a crash in which the cell wall must bridge 
a gap in the surrounding structure caused by structural displacement during a crash. If 
the cell wall comes in contact with sharp objects or tom structure at this time, it would be 
very vulnerable to puncturing and tearing. This type of failure was discovered early in 
the development of crash-resistant fuel systems and has been discussed at some length. 
Certainly the crash experience of the military helicopters, both with and without crash- 
resistant fuel systems, as well as the numerous helicopter crash tests conducted over the 
years, substantiate the need for high levels of puncture and tear resistance of fuel cell 
materials in all helicopters. 

A study conducted for the FAA in 1994 found that ten models of civil helicopters incorporated 
some degree of crash resistance in their fuel systems at that time [40]. The primary purpose of 
the study was to identify levels of crash resistance that could be incorporated into civil 
helicopters in different areas, including the fuel system. This study also recommended a 50-foot 
drop test for the fuel cell versus the 65-foot drop required by the military. 
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TABLE 2-2. CRFS FUEL CELL MATERIAL COMPARISON (circa 1983) 


Test/Description 

Standard 

Bladder 

US-566RL 

Safety 

Cell 

US-770 

Safety 

Cell 

US-756 

ppj** 

FPT/ 

CR.615 

Military 

MIL-T- 

27422B 

US-751 

Drop height with no 
spillage (ft) 

NA 

50 

(80% 

Full) 

50* 

(80% 

Full) 

65 

(Full) 

65 

(Full) 

Constant rate tear (fit-lb) 

NA 

400 

210.0 

42 

400 

Tensile strength (lb) 






Warp 

140 

168 

1717 

NA 

NA 

Fill 

120 

158 

1128 

NA 

NA 

Impact penetration 






(5 lb Chisel) 






Drop height (ft)) 






Parallel/warp 

NA 

1.2 

8.5 

10.5 

15 

45° Warp 

NA 


8.5 


15 

Screw driver (lb) 

25 

333-446 

370.5 

NA 

NA 

Material weight (lb/ft 2 ) 

0.12 

0.36 

0.40 

0.55 

1.04 

Weight increase factor 

l.Ox 

3. Ox 

3.3x 

4.6x 

8.7x 


* Also dropped from 65 ft with no spillage 
** 350% Elongation 

Design configurations proposed for civil helicopter CRFSs included crash-resistant fuel cells; 
flexible, steel-braid-covered hose for fuel lines; self-sealing breakaway valves where the fuel line 
passes through the firewall and at other locations where necessary (e.g., tank outlets, tank cross- 
feed lines); frangible attachments for all tank component-to-structure attachments; suction fuel 
feed; and means of preventing fuel spillage through the vents. The development of CRFS 
technology had come far enough by this time that the study report was able to list manufacturers 
of crash-resistant fuel cells, fuel lines, and self-sealing breakaway valves for the civil aircraft 
industry. 

In 1990, the FAA proposed amendments to Title 14 CFR, Parts 27 and 29, to minimize postcrash 
fire in survivable helicopter impacts by specifying new requirements for fuel system crash 
resistance in civil rotorcraft. The Final Rule, effective in 1994 for newly certificated aircraft, 
adds Sections 27.952 and 29.952, respectively, titled Fuel System Crash Resistance. These 
sections require 50-foot drop tests for each fuel tank; minimum inertial load factors for tank 
design and installation; self-sealing breakaway couplings at tank-to-fuel line and tank-to-tank 
connections and at those points in the fuel system where local structural deformation could lead 
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to the release of fuel; frangible or deformable attachments between fuel tanks and fuel system 
components to rotorcraft structure; and separation of fuel and ignition sources. In addition, rigid 
or semirigid fuel tank or bladder walls must be impact and tear resistant. These amendments 
incorporated many of the successful strategies that were imposed on military rotorcraft by MIL- 
T-27422B and MIL-STD 1290A. 

2.3.4 Airplane CRTS Development . 

Although the U.S. Army-funded CRFS research program had succeeded in the development and 
installation of CRFSs in military helicopters by 1970, the development of CRFSs for fixed-wing 
aircraft did not proceed as rapidly or with the same sense of urgency. The impact of the 
increased fire fatalities due to the Vietnam War undoubtedly spurred on the U.S. Army’s 
program while no such emergency existed in the civil sector. In addition, although the basic 
principles underlying the CRFS are the same for all aircraft, designing a CRFS for fixed-wing 
aircraft was inherently more difficult than designing for the relatively box-like structure of a 
helicopter. Thus, CRFS research and development efforts for fixed-wing aircraft continued. 

In the mid-1960s, around the same time that the full-scale C-45 crash tests were run (previously 
described in section 2.3.2), a series of tests were conducted on a DC-7 wing containing CRFS 
components [41], High-strength bladder fuel cells, frangible attachments, self-sealing 
breakaway valves, and fiberglass protective liners were installed in one section of the wing in 
place of the standard bladder cells and the integral tank. The standard tanks remained in the 
other section of the wing. The wing was mounted on a jet-propelled dolly and accelerated into a 
decelerator. Eleven controlled deceleration tests ranging from 2-21 G’s were conducted. There 
were no failures in either the standard or crash-resistant fuel cells and there were no inadvertent 
valve closures in the CRFS. 

A final destructive test was conducted where the wing was run into two vertical poles (at 77 kts) 
positioned to shear the wing panels at the outboard nacelles. Both outboard nacelles were 
severed from the wing. The standard fuel system integral tank was split vertically and the 
bottom skin and center spar were tom free. The outboard bladder cell was ripped and punctured. 
All of the fuel was lost before the test specimen could be stopped. The CRFS front and rear 
outboard cells were punctured and the rear cell was also ripped by structure after the liner was 
tom free. All of the self-sealing valves functioned satisfactorily except for two 3-inch transfer 
valves between ruptured and undamaged cells. It was concluded that the breakaway valves, 
which were actuated by cables containing weak links, needed a more positive means of 
triggering. However, it took 1 7 minutes for all the fuel to drain from the CRFS compared to the 
near instantaneous fuel loss from the original fuel system. 

Subsequently, in the late 1960s, the FAA conducted more DC-7 wing section tests to determine 
the capability of a CRFS using ARM-021 fuel tanks [42]. The three tanks in each wing were 
interconnected with cable-lanyard-actuated self-sealing breakaway valves. The void between the 
tank walls and skin was filled with Styrofoam backing board. The wing sections impacted a log 
and steel stanchion held in place by two shear pins. Twenty- five-mph tests were conducted with 
a pendulum facility and 75-mph tests were mn on a catapult and track facility. 



The first two low-speed tests were not severe enough to damage the cells or actuate the valves. 
A third test resulted in the stanchion intruding 16 inches into the middle tank. All of the valves 
closed but there was a slight cut in the tank from jagged metal (6-gal/hr leakage). The first 75- 
mph test pulled the center cell from its frangible fastenings to the wing structure. The valves 
closed but there was a small leak (10 gal/hr) from a piece of metal piercing the cell. In the 
second 75-mph test, the middle cell was tom from the frangible fastenings, activating the valves. 
The wing flipped over and slid upside down, resulting in a broken filler cap and the loss of all 
fuel in the center cell. However, there was no loss from the other two interconnected cells 
because the self-sealing breakaway valves closed. In any case, the leakage rates were much less 
than with integral tanks. The researchers concluded that a foolproof method to prevent 
inadvertent closing of the self-sealing breakaway valves was needed so these kinds of valves 
could be used in fixed-wing aircraft. They also believed this system was feasible for air taxi 
airplanes and that the safety advantage outweighed the weight and volume penalties associated 
with the system. 

In the mid-1960s, efforts were under way to improve the crash resistance of integral fuel tanks 
without using bladder cells. The FAA sponsored a study to develop design improvements in 
transport airplane integral tanks to enhance fuel containment during survivable crashes [43]. The 
study determined that the most critical loading condition was concentrated impact along the front 
spar and lower surface as the airplane struck obstacles such as trees and poles. The most likely 
loading was due to distributed impacts, as in a wheels-up landing. However, any wing that could 
break trees could sustain severe ground contact loads. Reinforcements which would allow 
conventional structures to break poles consisted of strengthening the front spar rails and skin 
panels aft of the rails. Analyses showed that, if the reinforcing material were added primarily to 
the lower rail and lower surface, fuel containment would be efficiently improved for both the 
most critical and most likely crash conditions. 

The analytical results were substantiated by an extensive test program with full-scale fuel tanks. 
The tanks were dropped onto obstacles simulating concentrated impacts and onto an inclined 
mound to simulate distributed impacts. The results of the study indicated that substantial 
improvements in fuel containment could be designed into wings similar to those currently used 
(circa 1960). The authors also stressed the need for fuel containment in the fuel lines, and stated 
that shutoff valves must be positioned so they are not tom off if the engine is tom off. They also 
recommended that the valves should automatically shut off if the engine was displaced. (The 
valves could be actuated by engine displacement or use of a quick-disconnect feature.) 

Subsequent tests conducted by the FAA in the late 1960s on two DC-7 outer wing panels, which 
had been structurally reinforced, ended with mixed results [44], The outer wing panel of one of 
the wings was strengthened chordwise with a 0.040-inch-thick aluminum doubler. The other 
wing panel had a 0.020-inch-thick aluminum doubler installed in a similar manner and also had 
chordwise aluminum tee sections extending from the front of the spar cap to slightly aft of the 
second spanwise stringer at 6-inch intervals. The wings were swung on a pendulum to impact a 
pole mounted with a shear pin to limit loads. Impact velocities of 27 mph resulted in G forces as 
high as 25. The first modified wing ruptured almost as much as an unmodified control wing. 
However, the wing reinforced with the tee sections did not rupture. 
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The FAA also conducted a study in this same time period to evaluate the crash resistance of a 
typical jet transport wing leading-edge fuel tank [45]. The primary purpose was to investigate a 
drop test method for testing wing leading edges. The wing was mounted vertically under the 
drop tower and the impact article was dropped, in a horizontal position, onto the wing leading 
edge. The impact article was accelerated up to the desired speed by a bungee cord. Obstacles 
used were pine logs, angle iron, and steel poles (pipe). Test results showed that failure of the 
leading edge occurred at approximately 93 mph with the log and 74 mph with the pipe. The 
researchers concluded that the test setup was an acceptable way to evaluate the strength of 
leading-edge fuel tanks without fuel in the tanks. The pipe was the best test obstacle because it 
was the most repeatable. The researchers proposed the following test criterion: the wing should 
withstand without cracking or rupture an impact of a 4-in.-diameter pipe with an impact velocity 
equal at least to one-half of the stall speed of the aircraft at maximum takeoff weight. 

Alternate methods also were being investigated to improve the fuel containment capabilities of 
integral tanks during airplane crashes. The FAA conducted tests on F-86 droppable fuel tanks 
filled with 10 or 60 ppi reticulated polyurethane foam [44]. Some tanks were dropped onto a 
concrete pad at 32.5 mph. Other tanks were catapulted into a steel plate on a sloped earthen 
embankment at speeds of 80 mph in the presence of an open flame. The drop tests showed that 
the fuel spray patterns for tanks without foam and those with foam were similar relative to the 
depth of horizontal and vertical areas encompassed. Thus, the possibility of spray contacting an 
ignition source would be the same for both. The catapult tests showed that, in all configurations, 
fuel spray ignited within a time interval of 40 to 60 msec. Thus, the presence of the foam was 
considered quite insignificant to crash fire safety. 

Additional concepts investigated were the use of elastomeric liners and curtains inside the fuel 
tank to maintain the integrity of the fuel tank during crashes, with the secondary purpose of 
reducing fuel flow if integrity was lost. Initial laboratory tests resulted in two feasible liners for 
integral fuel tanks: (1) a frangible bond/extendable film, which could drape wounds or 

encapsulate penetrating objects and (2) several inches of foam bonded to the inside of the tank 
wall to reduce flow through a puncture wound if integrity was lost [46], Subsequent drop tests of 
these and other liner and curtain concepts showed that, if the liners or curtains were thin enough 
to conform to the damaged tank structure and seal the wound, they would be punctured. If they 
were strong enough to resist puncture, they would not conform to the structure and fuel would 
flow around them and out the wound [47]. The investigators concluded that no system 
dependent upon the continued support of the aircraft structure would be successful in eliminating 
or controlling postcrash fuel spills and these concepts were abandoned. 

Research and development efforts for transport airplane CRFS technology languished during 
most of the 1970s as efforts were focused instead on improving the crash safety of general 
aviation airplanes, including the development of CRFS fuel systems for these aircraft. In 1973, 
NASA and the FAA began a 10-year joint study on the crash dynamics of general aviation 
airplanes under controlled, ffee-flight conditions [48 and 49], The object of this program was to 
determine the dynamic response of airplane structures, seats, and occupants during a crash and to 
determine the effect of flight parameters at impact on loads and structural damage. Twenty-one 
full-scale, instrumented crash tests were conducted using a gantry structure and allowing the 
aircraft, suspended and guided by cables, to swing pendulum-style onto the impact surface (see 


figure 2-8). Analysis of the test data resulted in representative floor deceleration pulses, which 
could be used for postcrash analysis and comparisons to human tolerance data, as well as 
establishing the parameters for the development of crash-resistant structures and improved seats 
and restraints. 


MOVEABLE BRIDGE 



FIGURE 2-8. FULL-SCALE CRASH TEST METHOD 


Concurrently with the crash tests described above, the FAA conducted four full-scale crash tests 
of light twin-engined airplanes with experimental CRFSs [50 and 51]. The tests were done to 
evaluate the performance of various light-weight, flexible, crash-resistant fuel cells with self- 
sealing breakaway valves installed in the fuel and vent line outlets. Since the fuel tanks would 
be located in the wings ahead of the main spar, they had to be lighter weight and more flexible 
than the MIL-T-27422B tanks, but tear and puncture resistance were still primary criteria. Five 
types of tank materials were used consisting of one to three plies of fabric with fabric weights 
from 5.50 to 12.75 oz/sq yd. A standard bladder tank was also used in one of the tests. The self- 
sealing breakaway valve installed in the fuel line outlet was activated by an actuating arm 
installed to impact the attached fuel line (aluminum tubing) as the airplane contacted the ground 
(see figure 2-9). 
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FIGURE 2-9. SELF-SEALING BREAKAWAY VALVE INSTALLATION (WING ROOT) 

The tests were conducted on a catapult test track. After the airplane was accelerated up to speed, 
the landing gear was knocked off by an I-beam barrier. The airborne airplane then struck a 4° 
earthen embankment containing embedded steel poles to impact the wings (two on each side). 
Impact speeds ranged from 93 to 95 ft/sec. 

The test results are shown in table 2-3. Both one-ply tanks made from fabric whose weight was 
less than 12.75 oz/sq yd failed. The original bladder tank failed catastrophically. There was no 
damage to the remaining tanks. The self-sealing breakaway valves performed satisfactorily in all 
of the tests. The authors cautioned that these tests with the light-weight tanks were not 
applicable to belly or nacelle tanks whose shape would not allow the tanks to increase in volume 
during impact, thus letting hydraulic pressure remain low. Nonetheless, the feasibility of 
designing increased crash resistance into the fuel systems of general aviation airplanes was 
firmly established. 
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TABLE 2-3. CRASH TEST DATA 



Fuel 

Tank 

L.H. 

Fabric 

Weight 

(oz/sq.yd) 

Fuel 

Tank 

R.H. 

Fabric 
Weight 
(oz/sq. yd) 

Aircraft 

Weight 

lb 

Impact 

Speed, 

ft/sec 

Maxin 
Accelei 
. (gj 

Hum 

ation 

Damage 

1 

2-Ply* 

US758 

12.75 

3-Ply 

US759 

12.75 

2,660 

93 

Fwd 

Up 

None to either 
tank 

2 

2-Pl;y 

US758 

12.75 

Original 

Aircraft 

Bladder 

Cell 


2,660 

93 

15 

5 

None to either 
tank 

R.H. tank 
ruptured 

3 

2-Ply 

US758 

12.75 

1-Ply 

US764 



95 

29 

7.5 

None to either 
tank 

4 

1-Ply 

US768 

5.50 

1-Ply 

USA762 

8.00 

2,590 

95 

27 

55 

Both tanks 
failed; 

R.H. tank 
received minor 
damage 


*This tank was previously drop tested from 39 ft. 


In March 1985, the FAA issued ANPRM 85-7 to elicit comments on the FAA’s intent to 
incorporate standards for crash-resistant fuel systems into 14 CFR Part 23. In response, the 
General Aviation Safety Panel (GASP), an industry-government group formed at the request of 
the FAA, addressed the feasibility of improving the crash resistance of general aviation airplane 
fuel systems. Although GASP felt that the installation of crash-resistant fuel tanks in place of 
existing metal tanks or integral tanks would not be feasible, it did recommend the use of self- 
sealing breakaway valves at the wing/fuselage, firewall/engine-mount, and tip tank/wing 
junctures and the dry-bay area behind an engine if used to carry fuel. GASP also recommended 
that any fuel tank located in an engine nacelle or any fuselage tank located between the engine 
and an area occupied by either pilots or passengers, or any fuel tank external to the wing’s 
contour (excluding tip tanks), should comply with the requirements of MIL-T-27422B, with the 
exception of some lower requirements similar to those incorporated for the civil helicopter fuel 
tanks. 

The FAA issued NPRM 85-7A for Crash-Resistant Fuel Systems in General Aviation Aircraft 
(14 CFR Part 23) in February 1990, which incorporated the GASP recommendations and also 
included placing bladders in wing-tip tanks and self-sealing breakaway valves between 
interconnected tanks. This proposed rule making was canceled by the FAA in December 1999 
because the costs of the proposed change are not justified by the potential benefits.” 

Efforts to develop CRFS components for transport category airplanes resumed following a public 
hearing by the FAA in June 1977. The hearing was held to obtain further information on a 
proposed requirement for the installation of an explosion prevention system for each fuel tank 
and fuel vapor and vent space to control postcrash fuel system fires and explosions. The public 
hearing confirmed previously submitted written information that fuel tank nitrogen inerting, 
foam filler, and chemical agent explosion suppression systems, although effective in preventing 
fire and explosion in undamaged fuel systems, cannot prevent external fires caused by fuel 
released from damaged fuel tanks under crash conditions [52]. 
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It was suggested at this hearing that antimisting kerosene might reduce the fire hazard from fuel 
tanks damaged during a crash. Participants at the hearing also recommended that crash-resistant 
tanks and self-sealing breakaway valves be developed for fuselage fuel tanks and that breakaway 
valves be installed in the fuel lines between tanks and engines. As a result of this hearing, and a 
second hearing in November 1977 dealing with the fire worthiness of compartment interior 
materials, the FAA established the Special Aviation Fire and Explosion Reduction (SAFER) 
Advisory Committee on June 26,1978. The Committee was to “....examine the factors affecting 
the ability of the aircraft cabin occupant to survive in the postcrash environment and the range of 
solutions available.” 

The SAFER Committee was composed of 24 members in addition to the chairman and executive 
director. Airlines, manufacturers, universities, public and private sector research establishments, 
flight and cabin crews, and consumer organizations were all represented. The Committee met 
for the first time in May 1979 and, in view of the short term remaining (13 months), limited the 
scope of its activities to transport category aircraft and to aircraft design aspects relating to fire 
and explosion reduction in impact survivable accidents. To provide the detailed information 
needed by the Committee, two technical working groups were organized; one on compartment 
interior materials and one on postcrash fuel system fire hazard reduction. These working groups 
also employed specialist subgroups to provide additional expertise in each area. The subgroups 
in the fuel system fire hazard reduction group were (1) explosion suppression, fuel tank 
foam/foil, and fuel tank inerting; (2) crash-resistant fuel tanks; and (3) antimisting fuels. 

The SAFER Committee released its final report in June 1980 [53], The Committee found that 
the major hazard in postcrash aircraft fires is the aircraft fuel system. Ignition of aircraft fuel 
spilled due to structural breakup during a crash is the primary cause of nearly all aircraft 
postcrash fires. Technical committee findings and recommendations for fuel system fire hazard 
reduction were as follows: 

(1) Explosion suppression, etc. The Committee concluded that these systems would be 
effective only in those cases of minor damage (no major fuel tank rupture) where external 
fire would be far less severe. In such circumstances, equivalent protection could be 
provided by a flame arrestor in the fuel tank vent line and by a system that ensures that 
the engine fuel supply is shut off in potential fire situations. Both suggested 
improvements were based on existing technology. 

(2) Crash-resistant fuel tanks. The Committee concluded that it is feasible to install crash- 
resistant fuel cells in the fuselage and that it may be feasible to incorporate some degree 
of crash resistance in critical wing fuel tank locations. However, it is not feasible, in 
most conventional transport airplanes, to install crash-resistant fuel tanks in the wings. 

(3) The Committee felt that antimisting fuels held the most promise for reducing the fuel fire 
hazard, although more development and testing was needed before feasibility could be 
established. 

Two additional Committee recommendations were made that are very pertinent to reducing the 
fuel fire hazard. One was to develop realistic airplane crash scenarios with emphasis on crash- 
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induced fuel system failure modes and their effects on postcrash fire safety. Fuel system design 
criteria and regulations could then be developed using the crash scenarios as a basis. The second 
recommendation was that the FAA and NTSB jointly improve and standardize postcrash 
accident investigations with added emphasis on identifying the role of design features that affect 
the development and spread of postcrash fires. Features that contribute to fire safety as well as 
those that contribute to fire hazards should be identified. (This topic is discussed in more detail 
in section 4.) The SAFER Committee also pointed out that the differing definitions of “impact- 
survivable” accidents complicate CRFS design for transport airplanes, but offered no alternative 
definition. 

Note: The basic tenet of CRFS design is to produce a fuel system which will contain its fuel (or 
minimize spillage) in accidents up to the limits of human survivability. The U.S. Army 
and the NTSB both define a “survivable accident” as one in which an occupiable space is 
maintained around the occupant and impact forces transmitted to the restrained occupant 
do not exceed human tolerance limits. The FAA, on the other hand, has historically 
defined survivable accident as one in which at least one occupant survives the impact. 
Neither of these definitions is acceptable for transport airplane design purposes. 

The U.S. Army definition has been used quite successfully for many years as a basis for 
crashworthy design. This is possible because of the relatively small size of helicopters 
(and small, general aviation airplanes) which ensures that the aircraft as a whole, and the 
occupants therein, experience comparable forces during an impact. In transport airplanes, 
however, the large size of the aircraft allows different sections of the aircraft (and their 
occupants) to experience dissimilar forces during a crash, sometimes by an order of 
magnitude or more. Therefore, the question arises as to what part of the airplane the 
survivable definition should be applied to - the fuel tank area or areas away from the fuel 
tank which may experience lower crash loads? 

On the other hand, the FAA definition of survivable crash is based on the outcome of the 
accident, which furnishes no basis at all from which the designer may work. Outcomes 
are often unpredictable and undefined for the accident population as a whole. Without 
defining some predictable limits, a sound engineering basis for design is impossible. 

Defining realistic upper limit crash scenarios based on accident data would be a logical 
beginning. Fuselage section and full-scale airplane crash testing to these scenarios could 
then furnish the necessary data upon which crashworthy designs could be based. 

The recommendation by the SAFER Committee to develop realistic crash scenarios resulted in 
the FAA awarding contracts to three major domestic transport airplane manufacturers in 1980 to 
examine transport accident data in depth and to develop candidate impact-survivable accident 
scenarios for use in future crashworthiness R&D efforts [52], The results of these studies were 
published in 1982 and are discussed in detail in section 4. Based on these studies, three distinct 
scenarios with associated impact conditions were suggested, as shown in table 2-4 [54], 


* Proposed AC25-17A contains a definition of survivable crash which is a modified version of the U.S. Army and 
NTSB definition, see section 8.3.43. 
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TABLE 2-4. TRANSPORT AIRCRAFT CANDIDATE SCENARIOS 




IMPACT CONDITIONS 

Candidate 

Scenario 

Operational 

Phase 

Distance 

From 

Airport 

Forward 

Velocity 

(Vf) 

Sink 

Rate 

(Vs) 

Airplane 

Configuration/ 

Impact 

Conditions 

Terrain 

Hazard 

Ground 

to 

Ground 

(overrun) 

Takeoff 

abort/landing 

overrun 

On 

runway or 
within 
3000 ft. 
of end of 
runway 

60-100 kts 

Less 
than or 
equal to 
5 fps. 

Gear extended 
Symmetrical 

Runway 

Hard 

Ground 

Ditches 

Trees 

Mounds 

Light 

Stanchions 

Air to 
Ground 

(Hard 

Landing) 

Landing-hard 

Landing- 

undershoot 

On 

runway or 
within 
300 ft. of 
threshold 

126-160 

kts 

Greater 
than 5 
fps. but 
less than 
or equal 
to 12 fps 

Gear extended 
Symmetrical 

Runway 

Soft 

Ground 

None 

Air to 
Ground 

(Impact) 

Final 

Approach 

On 

runway or 

between 

outer 

marker 

and 

missed 

approach 

point 

Greater 
than 126 
kts 

Greater 
than 
12 fps 

Gear extended 
retracted 

Symmetrical 

Unsymmetrical 

Pitch 0° - 5° 
Roll 5° - 45° 
Yaw 0°-10° 

Flight Path 

-4° - -7° 

Hard 

Ground 

Hilly 

Rocky 

Trees 

Poles 

Slopes 

Ravines 

Buildings 


The studies concluded that the greatest potential for improved transport crashworthiness was in 
reducing fire-related fatalities (severe fuel fires accounted for approximately 36 percent of the 
fatalities in survivable accidents). Leading candidates for crash-resistant improvements were the 
structural integrity of fuel systems and fuselages and landing gear that are more tolerant of off- 
runway conditions. 

Also, in view of the SAFER Committee report, the FAA accelerated its existing program on 
antimisting kerosene (AMK). Following intensive investigations, including full-scale ground 
and flight tests, a B-720 airplane operating on AMK was flown remotely in a controlled impact 
test to demonstrate the effectiveness of AMK in an impact-survivable accident. (This program is 
described in section 2.4.) However, the demonstration indicated that control of the fuel fire with 
AMK was not yet feasible. 

Therefore, in 1985, the FAA awarded a contract to a major domestic airplane manufacturer to 
identify potential fuel containment concepts for reducing the postcrash fire hazard in the crash 
scenarios previously identified. During this program, an analysis of available crash test data and 
accident data allowed the researchers to develop the cause and effect relationships shown in 
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figure 2-10 [55], Based on this data, several approaches were formulated to improve fuel 
containment during survivable crashes. These were: 

• Approach No. 1 - Component Improvements 
Crash-resistant fuel system components 

Self-sealing breakaway valves (potential use in engine fuel feed line at pylon) 
Frangible fittings 

Flexible lines (used now where there is a high stretch potential and where relative 
displacement is anticipated) 

SAFER Committee recommendations 

Vent flame arrestor 
Emergency shutoff valves 

• Approach No. 2 - Wing Structural Modifications 

Wing span changes (front spar, leading edge, lower skin, forward skin redesign, and 
strengthening similar to reference 43) 

Wing root changes 

Increased strength 

Double wall construction 

Spanwise compartmentation of tanks (would need self-sealing fittings at cell-to-cell lines 
and wing root) 

Energy absorbing devices 

• Approach No. 3 - Fuselage Fuel Containment 

Crash-resistant fuel tank material 
Crash-resistant fuel system components 

The above concepts were analyzed regarding benefits and penalties and prioritized in order of 
effectiveness based on the ratio of fleet penalty (weight plus cost) to fatality reduction. The 
author concluded that fuselage fuel containment (Approach No. 3) rated highest and had the 
greatest near-term potential. Wing structural modifications would be long-term goals, but 
fuselage fuel containment, along with wing root structural modifications, would ultimately be the 
most effective approach. The least effective was structural modification of the wing span. 
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Structure Related 
Event 

Initial Structure 
Involved 

Subsequent Failures 

Fire Hazard 
Consequences 

Main gear collapse — 

or 

Retracted gears 

- Wing impact 

Engine separation 

Wing overload 
Lower wing tear .... 


■ Fuel line rupture 
Fuel tank rupture 


Fuselage impact 


Fuselage break/separation 
Fuselage crush 


Penetration into 
Wing box 


Wing tank overload 


Loss of center or 
Fuselage fuel tank integrity 


Loss of wing fuel tank 
integrity 


Contour or 
Slope impact 
(gears collapsed) 


Fuselage impact 

Wing impact 
(distributed load) 


Fuselage break impact 
Wing overload 

Lwr wing tear 

Engine separation 



Wing penetration — 

Wing overload 

Columns or 

Obstacle penetration 

(concentrated 

load) 

Fuel tank rupture 

Fuel tank overload 


Loss of center or 
fuselage wing tank 
integrity 


Fuel line rupture 


Fuel tank rupture 
Fuel tank puncture 
Fuel line rupture 


FIGURE 2-10. ACCIDENT EVENTS WHICH LEAD TO A FIRE HAZARD 

The study determined that design practices for fuselage fuel tanks could be separated into two 
distinct categories. One category consisted of using bladder cells in the lower fuselage of wide- 
body transports between the front and rear spars of the wing carry-through structure (see figure 
2-11). This installation avoids sections where the fuselage is likely to break during a crash. The 
surrounding beams and bulkheads provide stiffness and support in event of a gear-up impact with 
the ground. The fuel system components are located within the cell, protecting them to a certain 
extent. The author recommended that a more tear- and crash-resistant bladder be used to 
improve the tank’s crash resistance. In addition, energy absorbing crushable structure (i.e., 
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sandwich construction or equivalent) should be used between the tank cell and lower fuselage 
skin. 



FIGURE 2-11. BLADDER CELL INSTALLATION WIDE-BODY TRANSPORT AIRPLANE 

The other category of fuselage fuel tank in use consisted of a bladder within a dedicated 
structural box. This type of tank is used in both narrow- and wide-body airplanes. It is generally 
located in the lower fuselage cargo compartment. The tank is composed of an aluminum 
honeycomb outer shell with two bladder cells inside. It is supported from the passenger floor 
beams and fuselage frame as shown in figure 2-12. This design allows for tank displacement 
relative to aircraft structure and affords some available crush distance above the bottom fuselage 
skin. The fuel and vent lines connecting the auxiliary tanks to the main fuel system incorporate 
drainable and vented shrouds. In addition, these lines are either designed to break away from the 
auxiliary tank or sufficient stretch is provided to accommodate tank movement without causing 
fuel spillage. The author recommended using more tear-resistant bladders and self-sealing 
breakaway valves in the lines to make the tanks more crash resistant. 

Analytical studies (done by the KRASH computer program) also were conducted during this 
program. The analysis was based on air-to-ground and ground-to-ground fuselage impacts with 
no obstacles [55], These studies showed that initial sink velocities in excess of 22 ft/sec with 
zero pitch would likely break the fuselage shell and crush the fuselage underside 14 to 24 inches. 


2-34 




NOTE: DIMENSIONS ARE IN INCHES 



FIGURE 2-12. FUSELAGE FUEL TANK GENERAL ARRANGEMENT AND 

ATTACHMENT 


The researchers suggest the velocity envelope depicted in figure 2-13 be used for crash design 
purposes because the airframe should not break up within this envelope and, thus, could be 
considered survivable. 
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LONGITUDINAL VELOCITY CHANGE. FT/SEC 

FIGURE 2-13. SUGGESTED VELOCITY ENVELOPE FOR STRUCTURAL 
INTEGRITY BASED ON PRELIMINARY KRASH STUDIES 

A follow-on study conducted by the same manufacturer was performed to evaluate the 
performance under crash conditions of three contemporary fuselage fuel tank installations [56]. 
These installations were the two described previously plus a relatively small (160 to 440 gal) 
double-wall, cylindrical strap-in tank. These cylindrical tanks are generally located in an area 
where adequate fuselage crush is anticipated and away from break/separation regions. The 
author recommends relocating the interconnecting lines from below the tanks and external to 
above the tanks and internal, where possible, to improve their crash resistance. Also 
recommended is the use of flexible lines and breakaway fittings, as well as redundant support 
structure to prevent the tanks from breaking free. 

The KRASH computer program was used to develop anticipated fuselage responses during a 
crash. The crash conditions did not include any obstacle impacts either to the fuselage or to the 
wings. The KRASH analysis was used to generate a proposed crash design velocity envelope for 
floor-mounted components. The potential criteria were: 


• Dynamic Pulse (Triangular Shape) 

Vertical - only 

Velocity change, Av 
Rise time, t r 
Peak acceleration 

Longitudinal - only 

Velocity change, AAv 
Rise time, t r 
Peak acceleration 


= 25 ft/sec 
= 0.075 sec 
= 10.4 g 


= 30 ft/sec 
= 0.10 - 0.09 sec 
= 9.3- 10.2 g 
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The fuselage underside crush distribution, based on both test and analysis data, was: 

• Forward of wing section 14 inches 

• Wing center section 10 inches 

• Aft of wing section 1 6 inches 

A series of tests to evaluate various fuel tank installations and crash-resistant components was 
proposed. Two types of section tests were proposed to assess the performance of fuselage fuel 
tank installations; a longitudinal impact and a vertical impact with accelerations and velocity 
changes within the envelopes recommended above. 

Note: While these tests might be a reasonable starting point for evaluating the performance of 
the tank structure and installation hardware under dynamic loads, it should be noted that 
these tests simulate only one of the three crash scenarios of survivable accidents, the 
other two scenarios involving impacts into obstacles or uneven ground. In addition, there 
are many instances in the accident records where occupants have survived crashes in 
which the fuselage has broken apart and, in fact, where occupants have used these breaks 
as emergency exits. Thus, although the recommended test parameters might be sufficient 
for occupants near the fuel tanks, occupants farther away from the tank location might 
see considerably lower forces. If the tank were to fail only slightly above the test 
conditions, many occupants still might be put at risk of fire injuries or death during 
otherwise survivable crashes. 

In the early 1980s, NASA and the FAA each conducted several drop tests of transport airplane 
fuselages to acquire structural response data for computer programs such as DYCAST and 
KRASH, which were being developed for crash analysis of aircraft structures. The FAA 
expanded its test program during the 1990s to include seats, overhead bins, and fuselage fuel 
tanks. These tests are described in section 3. 

2.4 MODIFIED FUEL . 

Aircraft crash testing following World War II (WWII) showed that ruptured fuel tanks dump 
large quantities of jet fuel into the air stream before the airplane comes to rest. The fuel is 
sheared into fine mist as it travels through the air. The mist is explosively flammable, 
susceptible to ignition by sparks, hot engine parts, electrical arcing, and other conditions that 
occur coincident to the crash sequence. Once the mist is ignited, the flame front propagates 
explosively back to the point where the fuel was released and a large fire can rapidly consume 
the airplane before passengers can escape. 

Those concerned with accident injury prevention concluded early on that mitigation of the 
postcrash fuel misting phenomenon could be a key to reducing the number and severity of 
postcrash fires and their resulting carnage. 

2.4.1 Antimisting Kerosene . 

Decreasing the susceptibility of aviation kerosene fuel to atomizing (misting) soon became 
recognized as the most readily feasible methodology to reduce fuel misting. Thickening or 
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gelling known fuels could be employed to reduce their susceptibility to flowing after tanks and 
lines were breached. By making the thicker fuels cohesive, they would be less likely to atomize 
during the immediate postcrash spillage, and later spills would be minimized by the resistance of 
the fuels to flow readily. 

The U.S. Army and the FAA began conducting research into gelled and emulsified fuels in the 
mid-1960s in hopes that they could find a means for reducing the number of injuries and deaths 
caused by postcrash fires. The U.S. Army’s research, the more extensive of the two, was an 
attempt to. evaluate fuel emulsification in dynamic crash conditions. The U.S. Army testing 
progressed from laboratory experiments through 60 full-scale fuel cell impact tests, which 
demonstrated that the emulsified kerosene fuels (JP-8 and Jet-A) significantly reduced fire 
hazards in the postcrash environment [57]. 

Although the U.S. Army’s experiments achieved encouraging results in laboratory settings 
dealing solely with the characteristics of the fuels, the emulsified fuel burned profusely when 
crash tested in three T-33 jet trainers. These early failures opened the door to much more 
complex research designed to develop utilitarian methodologies for using a modified fuel in 
aircraft during real-world operating conditions. 

In 1978, the FAA entered into a cooperative effort with the United Kingdom’s (UK) Royal 
Aeronautical Establishment (RAE) and NASA to investigate the feasibility of achieving the 
transition of AMK from the laboratory to regular aircraft operations. In corollary inquiry the 
SAFER Technical Group on Postcrash Fire Hazard Reduction studied AMK progress to date and 
concluded that: 

“Although it appears to be the most promising candidate to reduce the fire hazard 
in a post-crash environment, much more development effort will be required 
before this potential can be realized” [53]. 

At the time (1979), the antimisting additive under study was FM-9™, a proprietary material 
produced by Imperial Chemical Industries (ICI) in the UK. The cooperative U.S./UK agreement 
encompassed research in both countries until the end of 1980, at which time a decision would be 
made either to continue development or abandon the concept as unworkable. The SAFER Anti- 
Misting Kerosene Sub-Committee identified several factors critical to AMK’s transition to 
operational usage: 

• Fundamental properties of the AMK/FM-9™ mixture and acceptable variances 

• “Degradation” or “restoration”: return of the AMK fuel mixture to its base fuel state 

• AMK production, quality control, and stability 

• Effects of water on AMK 

• Effects of AMK on engines and engine components 

• Actual fuel-air shear (anti-misting) experiments testing fuel release rates and airspeeds 

• Large-scale crash tests to determine performance in actual airplane crash conditions 
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The Sub-Committee concluded that: 


“The use of AMK will significantly reduce the fire and explosion hazard in a 
survivable accident by significantly reducing the propagation of flame through 
fuel mists such as might occur during an aircraft crash” [53]. 

The Sub-Committee recommended that research continue beyond 1980, the terminal date of the 
FAA/UK agreement, especially into those areas noted above where robust scientific data were 
lacking. 

In September 1980, the FAA initiated an Engineering and Development Program Plan on 
Antimisting Fuel. Later revised in 1985 after the Controlled Impact Demonstration (CID), the 
plan set up a phased research program to: 

• Determine the feasibility of antimisting fuel; 

• Develop recommendations for introduction and use in civil aviation; 

• Assess its effectiveness in a controlled impact demonstration; and 

• Assess its economic reasonableness in support of regulatory actions [58]. 

2.4.2 The Controlled Impact Demonstration . 

The CID was designed to demonstrate that (1) a jet transport airplane could operate solely on 
AMK; and (2) in a representative crash scenario, the AMK would prevent an airborne fuel mist 

from forming to support an explosive conflagration and limit the airborne fireball that had 

proved so deadly in past crashes. The Boeing-720 CID airplane was to be remotely piloted and 
crashed onto a prepared impact site in a scenario that would result in a “survivable” accident. It 
would be representative of typical takeoff, approach, landing, or missed approach accident. 

The impact scenario had the airplane on a 3.3° to 4.0° glide path with a 1° nose-up attitude on its 
final approach. With a sink rate of about 17 fps and neither roll nor yaw, it would hit the ground 
at 145-155 kt ground speed. The crash severity of the scenario would be within the survivable 
range. The landing gear would be retracted to increase fuselage impact forces. The impact site 
had been prepared with a packed stone bed to provide a friction ignition source over which the 
airplane would slide. Eight heavy steel structures were imbedded in concrete within the impact 
site, aligned to rip open the wing fuel tanks and guarantee fuel spillage. Operating approach 
lights were mounted in the slideout area to serve as electrical sources of ignition. Two jet-fueled 
flame generators were installed in the 720’s tail cone to imitate the ignition potential of aft- 
mounted engines and ensure ignition as the airplane slid through the spilled fuel in the event all 
other ignition sources failed. 

There were 73 dummies stationed within the cabin, of which 13 were fully anthropomorphic. 
The 13 were fitted with accelerometers in the head, thorax, and pelvis to measure impact and 
postimpact forces transmitted to “passengers.” Additional force sensors (175) were installed in 
the wings, fuselage, galley, floor, and overhead storage compartment. Sensor data were recorded 
both onboard the plane and telemetered to external recorders. 
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The B-720 was also equipped with 1 1 high-speed motion picture and video cameras inside the 
cabin, one high-speed movie camera on top of the vertical stabilizer, and two video cameras and 
a movie camera in the nose. About a hundred cameras were positioned around the crash site. 
The memorializing crew was rounded out by two photo helicopters and a U.S. Navy photo 
reconnaissance plane equipped with long-range, high-speed cameras. 

In December 1984, the CID B-720 took off from Edwards AFB, CA, loaded with 1 1,325 gallons 
of inline blended AMK. Winds were less than 5 kts. The plane intercepted its final approach 
path at 2300’ above ground level (agl) and began descent. At the 150’ agl abort decision 
altitude, it was on its 150 kt ground speed, but slightly below glide slope and to the right of final 
approach course. As the remote pilot attempted to correct the flight path, the left outboard (#1) 
engine struck the ground 410 feet short of the target box. The plane was in a 2° nose-down 
attitude, yawed 13° left. It immediately rolled about 10° left wing down, and the left inboard (#2) 
engine and fuselage struck the ground immediately thereafter. Both left engines spooled down to 
cutoff and separated at the pylons within two seconds, prior to reaching the wing-cutters. By 
then, its ground speed had slowed from 152 to 122 kts. It slid 500 feet before hitting the first of 
the eight steel wing-cutters at a 38° yaw angle. 

By the time the plane contacted the first wing-cutter, the swept leading edge of its right wing was 
almost perpendicular to the centerline of the impact zone, and both right engines (#3 and #4) 
were still running. The first wing-cutter entered the right side of the #3 engine nacelle and 
continued through the engine, stopping the compressor within one revolution. The cutter broke 
loose from its anchoring and rotated upwards under the wing, cutting into the inboard main fuel 
tank. Simultaneously, the second right-hand cutter ripped into the bottom of the wing, inboard of 
the #3 engine, causing sufficient additional damage to separate the right wing. 

The severed wing rotated forward ahead of the sliding airplane, releasing its fuel into an area of 
turbulence and recirculation that undoubtedly sheared the AMK, potentially degrading it to its 
previous Jet- A flammability characteristic. Rupture of the engines released AMK which had 
been restored prior to injection into the engines, as well as oil and hydraulic fluid. Ignition 
occurred within 0.14 second of the wing-cutter puncturing the engine and tank and resulted in an 
initial fireball that seemed to have all the characteristics of traditional fuel mist explosions. 

Because of its dependence on idiosyncratic rigidity, the CED scenario departed drastically from a 
“representative” crash. To assure that the CID would demonstrate what its sponsors desired to 
display, the impact area was designed to achieve predetermined rupture of the plane’s fuel cells 
and preplanned spillage precisely where it would be kindled by the prepositioned ignition 
sources. Those outcomes depended on the B-720 striking the ground precisely within a small 
50- x 200-ft landing area. As each physical obligation was added to the scenario, the likelihood 
of achieving every planned outcome diminished inversely. 

The FAA, NASA, and ICI were all convinced of the efficacy of AMK prior to the CID. They 
thought of the CID not as a test, but as a performance for the public with extensive press 
coverage. Unfortunately, the performance got out of control. The plane landed outside the 
planned envelope and the demonstration reverted to an experiment in which the outcome was no 
longer predictable. 
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Plane crashes seldom go according to plan. AMK had already been proved to be safer than 
ordinary jet fuel under a variety of crash circumstances. In retrospect, it would have been 
appropriate to demonstrate the effectiveness of AMK in a more typical crash scenario, rather 
than in the contrived environment attempted by the sponsors. Indeed, it is worthwhile 
contemplating the results of the CID had the heavy steel “cutters” been absent from the landing 
area, even with the same off-target landing. 

Ironically, it was precisely the by-products of public demonstration that led to the perception that 
the CID was a failure. Television coverage transmitted instantaneous images that the controlled 
crash had turned into a massive uncontrolled fuel-fed fire. Images of the fireball and plumes of 
black smoke gave the impression of disaster in the desert. If the public had held any hope for 
AMK’s minimizing the extent of postcrash fuel fires, it was dashed by those depictions. 

Yet the opposite was true. Despite the visual imagery, the initial fireball did not penetrate the 
fuselage. Later analyses showed that AMK splashing over the fuselage actually cooled it and 
helped prevent bum through. The initial fireball went out in 8 to 9 seconds, leaving substantial 
time for survivors of the initial impact to have escaped before the subsequent fuselage fire 
erupted. And that fire penetrated the fuselage primarily at breaches opened by the misaligned 
cutters which had been emplaced to rip open the fuel tanks. Although the conventional wisdom 
argues that similar stmctures would not often be found in a crash site, in at least two recent 
accidents the fuselage was penetrated and the fuel tanks breached by external mechanisms not 
wholly unlike the CID’s wing-cutters: the USAir 1493 B-737/Wings West Swearingen Metro at 
Los Angeles International (LAX), and AAL 1420’s MD-80 at Little Rock (LIT). 

The CID fires were not attacked by the firefighting means normally associated with FAR 139 air 
carrier airports. The secondary fire finally burned itself out after 1 1/2 hours. A final testament 
to the efficacy of AMK’s reduced flammability was 9,000 gallons of unbumt fuel which 
remained in and around the airplane. 

What might have been the case had the CID gone according to plan? In their book The Golem at 
Large, Harry Collins and Trevor Pinch commented: 

“We can easily imagine the demonstration going according to plan, the Boeing 720 
landing wheels-up without bursting into flames, and the TV cameras entering the 
fuselage of the unbumt aircraft and revealing pictures of putatively smiling 
unscorched dummies. Yet that scene too hides some hidden questions. Could it be 
that the particular crash was unusually benign so that AMK has the potential to make 
a difference on only very few crashes? Could it be that the extra machinery needed to 
turn jelly-like fuel into liquid before it enters the engines of jet planes would itself be 
a cause of crashes? Could it be that the transition period, requiring two types of fuel 
to be available for two types of plane, would be so hazardous as to cost more lives 
than the new fuel would ever save? Could it be that the extra cost of re-equipping 
airlines, airports, and airplanes, might jeopardize safety in other ways at a time of 
ruthless competition in the airline market? Again, perhaps there was too little time 
for anyone to escape between first and second fires; perhaps cabin temperatures rose 
so much during the first fireball that everyone would have been killed anyway 
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(authors’ note: absence of suitable temperature and toxic byproduct recording 

devices was an obvious omission in CID planning); perhaps there is always unbumt 
fuel left after a major crash; perhaps everyone would have died of fright” [59]. 

While the CID remains a topic of considerable debate, and while speculation is unending about 
what might have occurred if the demonstration had proceeded according to plan, the practical 
result of the CID was that serious interest in pursuing the use of AMK or other antimisting fuels 
disappeared. That result is the ultimate tragedy of the CID. The likelihood of being able to 
design a cost-effective CRFS for large transport aircraft that will protect all occupants in all 
locations within the aircraft from postcrash fire injuries and death is remote [60]. The aircraft 
fuel systems are so complex, their components are distributed in so many locations in the 
aircraft, and the crash loads experienced by various portions of the aircraft are so diverse that it 
is highly unlikely that there will never be an unsafe spillage of fuel. For those reasons, the best 
single contribution to eliminating postcrash fires would be the development of a fuel that is hard 
to spill, and if spilled is extremely difficult to ignite outside the engine, and if ignited would 
incorporate self-extinguishing characteristics. Research should be reinstituted on developing 
such a fuel. 
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3. TRANSPORT CATEGORY AIRPLANE CRASH TESTS. 


3.1 TEST DESCRIPTIONS . 

Many full-scale crash tests of transport category airplanes were conducted during the early 
efforts to define the postcrash fire problem and find solutions that would prevent or minimize 
crash fires. These tests, which have been described in section 2, were conducted using airplanes 
designed and constructed before the advent of modem jet transports. The FAA’s Controlled 
Impact Demonstration (CDD) test utilizing AMK is the only full-scale, forward-moving crash test 
of a transport category airplane conducted since the 1960s. (Because of the unique nature and 
complexity of the CID, it has been described by itself in section 2.4.2.) However, the drop tests 
and sled tests described in this section were all conducted using contemporary transport airplane 
fuselages, thus yielding data that is directly applicable to current aircraft. 

Two vertical drop tests of Boeing 707 fuselage sections were conducted by NASA in the early 
1980s. These tests were conducted to acquire structural response data to corroborate the 
DYCAST computer program and to determine structural, seat and occupant response to vertical 
loads to prepare for the upcoming CID test. The test sections included some passenger seats 
with instrumented dummies but no fuel system components. 

The first test utilized a 12-ft-long fuselage section located just forward of the wing [61]. The 
vertical test velocity was 20 ft/sec. The lower fuselage section (baggage compartment) collapsed 
inward near the section centerline approximately 2 feet. This collapse was caused by bending 
failures on both sides of the fuselage at one-third of the vertical height between the fuselage 
bottom and floor, as shown in figure 3-1. The maximum vertical acceleration at the bottom of 
the fuselage was 20 G’s while that at floor level it was only 12 G’s because of the crushing of the 
under floor structure. 

As can be seen in figure 3-1, the section is open on both ends. As the researchers who conducted 
the test pointed out, the crash response of a fuselage section would depend upon the transmission 
of forces and moments of inertia from the rest of the structure. They felt this interaction would 
be very difficult to simulate and, therefore, used a very simple tension cable system to provide 
outward radial restraint only. It is unclear how much this configuration might affect the 
magnitude of the results. 

The second drop test utilized a 13-ft-long section located at the rear of the wing. This center 
section included the wheel wells, keel beam, and part of the rear wing spar, as shown in figure 3- 
2 [62], Test velocity also was 20 ft/sec. There was no damage to the fuselage or floor. 
Maximum acceleration on the fuselage bottom equaled 71 G’s. The extremely stiff structure 
transmitted high loads to the floor, seats, and dummies in contrast to the lower loads transmitted 
by the softer structure ahead of the wing. 
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FIGURE 3-1. POSTTEST, FRONTAL VIEW OF TRANSPORT SECTION 

FORWARD OF WING 
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FIGURE 3-2. TRANSPORT CENTER SECTION SUSPENDED IN 
VERTICAL TEST APPARATUS 
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A third drop test of a B-707 fuselage section was conducted at the FAA’s Technical Center in 
1984 to develop and refine the test methodology [63]. This forward fuselage section also was 
dropped at 20 ft/sec. The fuselage was instrumented with structural accelerometers and 
displacement transducers (rod potentiometers) between the bottom of the fuselage and the 
bottom of the cabin floor. One instrumented dummy was onboard, but there were more dummies 
in other seats. The fuselage was dropped onto a load-measuring platform. The dynamic crush, 
obtained from the accelerometer data, was 18.4 in. (Data from the displacement transducers was 
not valid because of lateral displacement of the attachments as the structure crushed.) The 
measured static crush was 14.5 in. The crush pattern is shown in figure 3-3. The dummy data 
indicated that the impact was not injury producing. Several recommendations were made to 
improve the test methodology, including new attachments for the potentiometers and the use of 
digitized high-speed film data to determine dynamic crush. 



FIGURE 3-3. DEFORMATION OF B-707 FORWARD FUSELAGE SECTION FOLLOWING 

DROP TEST 

Several months after the B-707 drop test, an aft fuselage section of a DC- 10 was dropped at the 
FAA’s Technical Center using the same test setup and protocol [64]. The vertical velocity was 
also 20 ft/sec. All of the damage, which was slight, occurred below the cargo floor and was due 
to the buckling of the vertical supports for the cargo floor structure. This has been the only test 
of a wide-body airplane fuselage conducted to date. 
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Typical acceleration data from the section tests are shown in figures 3-4 and 3-5. The much 
higher accelerations generated by the stiffer structure of the narrow-body center section, in 
contrast to the softer forward section, can be seen in figure 3-4. Also of interest is the difference 
in acceleration levels across the width of the fuselage center section. This difference is 
not noticeable in the overall softer structure forward of the wing. The accelerations of the wide- 
body section, shown in figure 3-5, are much less than those of the narrow-body center section 
(figure 3-4(a)), but somewhat higher than those of the softer forward section (figure 3-4(b)). 



Time, sec Time, sec 


(a) Center Section 



(b) Forward Section 

FIGURE 3-4. ACCELERATION TIME HISTORIES OF B-707 FUSELAGE 

SECTION DROP TESTS 
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INTERSECTION 

FIGURE 3-5. WEDE-BODY FRAME SECTION TEST RESULTS 

In June 1984, a complete B-707 airplane (minus landing gear) was drop tested to evaluate the 
airframe strength characteristics. Data from this test were used to refine the KRASH model for 
the upcoming CID test [64], The drop test was structured to simulate the planned CID impact 
conditions except for forward velocity and aerodynamic loading. Sink speed was 17 ft/sec. 
Pitch attitude was 1 degree nose up and roll was 0 degrees. 

After the test, the lower fuselage of the B-707 was crushed and frame failures were noted on the 
centerline and along the sidewall. The extent of damage was greater in the aft region than in the 
forward cargo bay. Estimated crush was about 2 in. aft of the nose gear bulkhead; 4 in. forward 
of the wing leading edge; and 11 to 13 in. aft of the main landing gear bulkhead. Crushed 
ducting along the wing box keel indicated that the structure had deflected at least 6 in. in this 
area. The bulkhead at the wing trailing edge ruptured and pushed the floor upward at least 4 in. 
at the center, severing the transverse beams and seat tracks at that location. Since no floor 
accelerations were recorded, the observed damage could not be related with quantitative 
response levels. 

There was no wing fuel tank damage due to impact except at the wing tip, which initially 
contacted the ground as the wing flexed. The upper strut attach points of the left wing inboard 
engine pylon failed, but the engine lodged between the wing and the ground. 

The FAA conducted two longitudinal tests on a 10-ft section of a B-707 several years later to 
generate baseline data for KRASH and other analytical programs [65]. The fuselage section was 
just forward of the rear galley. It contained three rows of two triple-passenger seats with 
dummies in each seat. The seats had been strengthened to meet the higher expected loads. 
There were no fuel system components onboard. The fuselage was mounted on a Hyge sled and 
tested at input levels of 7.4 G’s (22 ft/sec) and at 14.2 G’s (36 ft/sec). Neither the fuselage shell 
nor the floor structure was damaged. The floor and fuselage accelerations were basically the 
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same. Peak accelerations were 7. 6-7. 8 G’s for the lower speed test and 14.7-15.0 G’s for the 
higher speed test. 

In 1992, the FAA conducted a vertical drop test on a commuter category Metro III airplane 
fuselage [66]. The purpose of the test was to measure the structural response of the fuselage, 
floor, seats (standard and modified), and dummies. The test setup is illustrated in figure 3-6. 
The engines and nacelles of this low-wing aircraft are below the lower molding of the fuselage 
structure. It was assumed that they would contact the ground prior to or simultaneously with the 
fuselage. Thus, the inertial loads from the wings and engines/nacelles would be directly reacted 
by the ground and not transferred into the fuselage. Therefore, their mass was not critical to the 
test results and the wings were removed, so there were no fuel tanks or engines on the test article. 
The landing gear and vertical and horizontal stabilizers also had been removed, leaving only the 
fuselage with the center wing box. The vertical impact velocity was 26.32 ft/sec. Peak 
accelerations were 40 to 60 G’s throughout the airframe. Deformation along the entire length of 
the fuselage was less than 2 inches. 


'40 FT. 
(REF.) 


ELECTRICAL WINCH 



FIGURE 3-6. DROP TEST SETUP FOR METRO III FUSELAGE 


Several years later (1995) another vertical drop test was conducted on a commuter category 
airplane — a Beechcraft 1900C [67]. The Beechcraft is a low- wing, twin-turboprop airplane. The 
purpose of the test was to measure the impact response of the fuselage, cabin floor, seats 
(standard and modified), and dummies. As in the Metro III test, the wings, engines, landing 
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gear, and vertical and horizontal stabilizers were removed prior to the test; thus, there were no 
fuel tanks onboard. The fuselage was dropped from a height of 1 1 .2 ft, impacting with a velocity 
of 26.8 ft/sec. Accelerations on the fuselage were 140 to 160 G’s, but acceleration levels on the 
dummies showed that this was a severe but definitely survivable impact. Deformation along the 
bottom of the fuselage ranged from 0.3 to 1.6 in., the latter occurring in the empennage portion 
of the fuselage. 


The first test in which any part of the fuel system was involved occurred in 1993. A 
vertical drop test was conducted by the FAA of a 10-foot tapered section of a Boeing 707 [68]. 
Figure 3-7 illustrates the test configuration. Seats and dummies were installed to achieve the 
desired test weight. The outer floor beams at each end of the section were reinforced to 
minimize the open end effects. The focal points of the test were the overhead bins and the 
auxiliary fuel tank. The auxiliary fuel tank was a 330-gallon, double-wall cylindrical tank 
mounted in a cradle which was attached to the underside of the fuselage floor, in the area noted 
in figure 3-8. The tank contained water to simulate the weight of a tank full of fuel and was 
pressurized to 2.5 psi. 



FIGURE 3-7. DROP TEST CONFIGURATION FOR A B-707 FRAME SECTION 

WITH AUXILIARY FUEL TANK 
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BS - Body Station 


FIGURE 3-8. B-707 TEST SECTION— SIDE VIEW 

The fuselage section was dropped onto a load-measuring platform. Impact was at 30 ft/sec. The 
average fuselage maximum acceleration was 36 G’s for a 57 msec idealized triangular pulse. 
Measured peak G’s ranged from 32 G’s at the front to 44 G’s at the rear. The average maximum 
fuel tank deceleration was about 31 G’s. The force applied on the tank was distributed to the 
cradles and straps supporting the tank. The data from the test dummies indicated that the impact 
was severe but survivable and moderate injuries could have been expected. The authors noted 
that the measured accelerations were higher than expected because the installation of the 
auxiliary fuel tank prevented additional fuselage crushing. 

Figure 3-9 shows the fuselage section following impact. The crush of the lower fuselage 
averaged 16.6 in. at the front and 6.4 in. at the rear. Maximum crush was 19.6 in. at the left 
front. The auxiliary fuel tank remained attached but the center lower surface of the tank crushed 
inward approximately 4 in. due to the protrusion of the fuel discharge line hardware. Both the 
inner and outer walls cracked around the welding of the fuel line outlet, allowing fluid to leak 
out. It was concluded that the redesign of the fuel tank discharge plumbing might prevent such 
tank rupture and leakage. 
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FIGURE 3-9. FRONT VIEW OF TEST SECTION AND FUEL TANKS AFTER IMPACT 

The next test of a fuselage fuel tank came during a series of three longitudinal acceleration tests 
on a 10- ft fuselage section of a Boeing 737, Model 200 conducted in 1997. These tests were 
conducted at the Transportation Research Center using their 24-inch Hyge sled [69]. The 
fuselage section was configured with two stowage bins and a 500-gallon auxiliary fuel tank 
located in the cargo area. The fuel tank was a Patrick Aircraft Tank System attached to the 
underside of the cabin floor beams, as shown in figure 3-10. The tank was filled with water. All 
of the tests involved triangular acceleration pulses. Peak sled accelerations for Tests 1, 2, and 3 
were 6.1, 8.2, and 14.2 G’s respectively. Corresponding test velocities were 23.2, 32.2, and 41.7 
ft/sec. 

There was no visual evidence of fuselage or stowage bin deformation during Test 1. However, 
the auxiliary fuel tank broke loose from its attachment framework approximately 75 to 85 msec 
into the acceleration pulse. It was eventually restrained by the test fixture approximately 50 
msec later, after it had moved almost two feet. The front edges of the tank’s aluminum side rails 
had sheared off against the front stops of the attachment framework and the lower attachment 
straps had broken loose from the airframe’s cargo floor. Recorded acceleration data was 
compromised when the tank impacted the test fixture, producing data spikes in the cabin floor 
accelerations. The tank was removed for the next two tests. 
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FIGURE 3-10. AIRFRAME TEST SECTION WITH AUXILIARY FUEL TANK INSTALLED 

In October 1998, a Shorts 3-30 regional transport airplane was subjected to a vertical drop test 
[70], This aircraft is a high-wing, twin-turboprop airplane with a capacity of 30 passengers. The 
entire aircraft, minus landing gear, was dropped, as shown in figure 3-11. The main object of the 
test was to determine the impact responses of the fuselage, seat tracks, seats, and test dummies. 
However, because of the unique configuration and location of the fuel system, it also was 
included in the test. The fuel system contains two fuel tanks which are located on top of the 
fuselage, as shown in figure 3-12. Each tank holds 288 gal of fuel and is composed of two 
interconnected fuel cells. Although cells 1, 2, and 3 are physically housed together while cell 4 
is separate, cells 3 and 4 are interconnected and make up one of the tanks. The tanks were 
approximately 3/4 full of water to simulate a full tank of fuel. All of the fuel lines coming from 
the tanks were capped but the interconnect pipe between cells 3 and 4 was left in place. 
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FIGURE 3-11. DROP TEST SETUP FOR SHORTS 3-30 AIRPLANE 


CELL 3-4 



FIGURE 3-12. SHORTS 3-30 FUEL SYSTEM 
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The airplane was dropped with an impact velocity of 28 ft/sec. The maximum fuselage 
acceleration was approximately 90 G’s with a pulse duration of 15 msec (measured at the floor). 
Maximum crush was 1.3 in. with the average crush under the floor only about 0.1 in., indicating 
a very stiff structure. Acceleration measurements on the dummies showed a severe impact 
which would have resulted in moderate to severe injuries to the occupants. 

The external upper section of the fuselage sustained significant deformation because both fuel 
tanks intruded into the cabin area 1 to 1.5 ft, due mainly to the load the fuel tanks exerted on the 
fuselage ceiling. The fuel tanks broke loose from their mountings and large quantities of fluid 
spilled directly onto the dummies. There were numerous rips and tears in the tanks, the four 
gravity feed outlets were crushed, and fluid leaked from the interconnect pipes. (See figures 5-9 
and 5-10 in section 5.) 

The large quantity of fluid spilled would make a fire likely in the event of a real-world crash. 

This, coupled with the fact that the occupants would be drenched in fuel, would be catastrophic. 

The most recent drop test was conducted by the FAA in October 1999 [71], A B-737 fuselage 
section containing several rows of seats, test dummies, and an underfloor auxiliary tank was 
dropped from a height of 14 ft. The fuel tank, shown in figure 3-13, was a double-wall metal 
tank with honeycomb between the walls. There was no bladder inside the tank. 



Fuel Tank 


FIGURE 3-13. PRETEST VIEW OF A B-737 FUSELAGE SECTION WITH 
UNDERFLOOR AUXILIARY FUEL TANK 
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Fluid leakage from the fuel tank was readily apparent as a steady flow. This leakage was 
reported as being caused by the lower fuselage frame puncturing the fuel tank. The posttest 
damage to the fuselage is shown in figures 3-14 to 3-16. The cabin floor above the fuel tank was 
pushed upward several inches because of the incompressibility of the full tank, reportedly 
generating high G loads on the seats. 



FIGURE 3-14. POSTTEST VIEW OF A B-737 FUSELAGE SECTION 



FIGURE 3-15. BUCKLED FUSELAGE FRAME FORWARD OF AUXILIARY FUEL TANK 
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(a) Pretest 


FIGURE 3-16. FUSELAGE UNDERFLOOR STRUCTURE AND 
AUXILIARY FUEL TANK 


(b) Posttest 
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3.2 SUMMARY OF TEST RESULTS. 


The test conditions and results are summarized in table 3-1. Two points are immediately obvious 
upon examining the maximum G levels and the maximum crush obtained during these tests: 
first, the smaller commuter airplanes (Metro III, Beechcrafit 1900C and Shorts 3-30) all have 
much stiffer structures relative to the aircraft size and weight than the larger transports, with 
correspondingly smaller crush distances and higher G levels; and second, the variations in 
stiffness of the larger transport airplane structure depending on the part of the fuselage involved. 
The variation is easily seen when comparing the results of the first two drop tests of the B-707 
involving the softer structure ahead of the wing and the stiff structure just aft of the wing 
(including the rear wing spar, wheel wells, and keel beam). This difference in stiffness is also 
apparent in the B-707 test with the cylindrical auxiliary fuel tank where the crush in the front of 
the test section was over twice that in the rear. These results indicate that, when designing a 
fuselage fuel tank installation, the stiffness (potential G level and crush distance) of the specific 
planned tank location must be factored into the design rather than relying on generalized stiffness 
data for the overall fuselage. 

The tests conducted so far have involved three different fuel system configurations. None of 
these fuel system installations performed entirely satisfactorily during tests that were well within 
the range of human survivability. Clearly more work needs to be done to improve the crash 
safety of the fuselage auxiliary fuel tanks and later sections of this report address potential 
improvements and issues involved. The main fuel system of the Shorts 3-30 is outside the scope 
of the current study, but the serious deficiencies of the fuel system performance from the 
standpoint of fire safety are noteworthy. Improved fuel system design would surely improve the 
fuel system crash performance. 

The crush measurements from the complete B-707 airplane test compared to the results of the 
various section tests raise some questions about using the section test structural data for design 
purposes. The section tests showed that open-ended sections could crush more then might be 
expected. Yet, the complete fuselage test crushed more in the center section than the comparable 
section test, probably due to wing loading. 

The section tests do seem to be a valid method of testing components (e.g., overhead bins, seats, 
and auxiliary fuel tanks) in air-to-ground impacts with no obstacles involved. However, the 
vertical drop tests and longitudinal sled tests, although providing some indication of crash loads 
and crushing which might be encountered, do not test other forces and failure mechanisms which 
are more prevalent in actual crashes and that would be expected to affect fuselage fuel tank 
integrity. These mechanisms include combined longitudinal and vertical forces, the effect of 
obstacle impacts, and extensive structural displacement as the aircraft is being tom apart. 



TABLE 3-1. SUMMARY OF AIRPLANE FUSELAGE IMPACT TESTS 


Section Tests 

Aircraft 

Impact 

Direction 

Impact 

Velocity/fps 

Maximum 

G 

Pulse 

Duration/ms 

Max. 

Crush/in. 

Avg. 

Crush/in. 

Fuel 

System 

F. S. 

Performance 

B-707 (fwd of wing) 

Vertical 

20 

20 

NR 

24 

NR 

No 

NA 

B-707 (center) 

Vertical 

20 

71 

NR 

No Damage 

NR 

No 

NA 

B-707 (fwd) 

Vertical 

20 

NR 

NR 

18.4 (dyn) 
14.5 (s) 

NR 

No 

NA 

B-707 (aft) 

Longitudinal 

22 

7.8 

NR 

NA 

NA 

No 

NA 

B-707 (aft) 

Longitudinal 

36 

15 

NR 

NA 

NA 

No 

NA 

B-707 (aft) 

Vertical 

30 

36 


19.6 (front) 
8.4 (rear) 

16.6 (front) 
6.4 (rear) 

Aux. 

(cylind) 

(i) 

B-737 (fwd) 

Longitudinal 

23.2 

6.1 

NR 

NA 

NA 

Aux. 

(PATS) 

( 2 ) 

B-737 (fwd) 

Longitudinal 

32.2 

8.2 

NR 

NA 

NA 

No 

NA 

B-737 (fwd) 

Longitudinal 

41.7 

14.2 

NR 

NA 

NA 

No 

NA 

DC-10 (aft) 

Vertical 

20 

=37 

NR 

~2 

NR 

No 

NA 

Complete Fuselage Tests 

Aircraft 

Impact 

Direction 

Impact 

Velocity/fps 

Maximum 

G 

Pulse 

Duration/ms 

Max. 

Crush/in. 

Avg. 

Crush/in. 

Fuel 

System 

F. S. 

Performance 

Metro III 

Vertical 

26.32 

40-60 

NR 

<2 

NR 

No 

NA 

Beechcraft 1 900C 

Vertical 

26.8 

140-160 

NR 

1.6 

NR 

No 

NA 

Shorts 3-30 

Vertical 

28 

90 

15 

1.3 

0.1 (under 
floor) 

Main 

(overhead) 

( 3 ) 

B-707 

Vertical 

17 

NR 

NR 

2 (front) 13 
(rear) 

NR 

wing 

( 4 ) 


( 1 ) Leaked from cracks around fuel discharge line outlet. NR = Not Reported 

(2) Fuel tank broke loose. NA = Not Applicable 

(3) Fuel tanks broke loose. Massive spillage onto occupants inside cabin. 

(4) Damage at wing tip; engine pylon attach points failed. 

One additional result should be noted. Dummy measurements in the vertical drop tests indicate 
that all these tests produced forces which were survivable. Although the velocity changes were 
comparable to those recommended for crashworthy design based on results from the KRASH 
program (see section 2.3), the peak accelerations obtained from the test data are considerably 
higher than those recommended. Times to reach peak G were also longer in the tests. 
Additional test data which could be utilized to refine the KRASH program still further might 
resolve this discrepancy. 
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4. TRANSPORT AIRPLANE ACCIDENT DATA. 


4.1 THE PISTON ERA . 

In 1949, NACA published a bibliography of unclassified aircraft fire literature [72] that lists 
studies of postcrash fire from as far back as 1922. This awareness of the problem, along with the 
high rate of in-flight fires, was a major concern to aircraft designers in the post-WWII era. 

One of the early U.S. studies of the transport crash fire problem [2] reported that postcrash fire 
occurred in about 15 per cent of U.S. air-carrier accidents in 1946 and about 30 percent of the 
occupants died from the fire in these accidents. This report then reviewed fuel properties and 
ignition sources for both in-flight fires and postcrash fires. 

A 1951 report by a Civil Aviation Authority (CAA) engineer at an SAE meeting [73] indicated 
that, between 1938 and 1951, crashes not followed by fire were fatal to 60.8 percent of the 
occupants, and in crashes followed by fire, the rate was 84.6 percent fatal. This paper discussed 
test work on bladder tanks and self-sealing fittings, as well as findings from accident 
investigations. 

A civil Aeronautics Board (CAB) study in 1966 covered 153 accidents occurring in 1955-1964 
that were caused by or resulted in fire [74]. Of the 4,559 passengers and crew members 
involved, 1,955 persons were fatally injured, and 2,604 persons survived with varying degrees of 
injury ranging from severe to none. Fifty one (33%) of the 153 accidents were severe enough to 
fatally injure all onboard. An additional 28 (18%) accidents had fatalities and survivors. These 
accidents had a total of 1,161 occupants, of which 488 (42%) died. Of these deaths, 294 (60%) 
were due to fire. An additional 57 occupants were seriously burned. Of the 1,955 occupants in 
the 79 fatal and partially survivable accidents, 294 (15%) died due to the fire. The report 
provides a detailed description of some of the accidents where there were both fatalities and 
survivors and points up the need for additional work on fire prevention in design, as firefighting 
capability is rarely available during the short evacuation period after impact. 

4.2 THE JET ERA . 

In 1975, a NASA study by Stanford Research Institute covered accidents occurring to U.S. 
commercial aircraft during the period 1963-1974 [75], The focus was on determining the degree 
to which materials with improved fire resistance and/or decreased toxicity could reduce injuries, 
fatalities, and fire damage. During this period, there were 545 nonturbulence accidents, of which 
122 (22%) had a fire in the airframe. (They excluded accidents where there was no airframe 
damage and those where fires were confined to the engine and/or wheel well.) While only 22% 
of these accidents had fires, 75% of the fatal accidents involved fire. In at least 21 of the 122 fire 
accidents, the impact damage was relatively light and the fire damage was severe. Nearly half of 
the fire accidents were on landing. Overall, about 15% of the fatalities were due to fire, the same 
figure as in the 1966 study. 

Of the 71 fatal accidents involving fire, 39 were not impact survivable, 13 had some fatalities 
definitely caused by fire and 19 were not designated impact survivable or nonsurvivable (but 13 
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of these may have been survivable). Thus, in at least 45 (63%) of these fatal accidents it was 
immaterial whether fire occurred or not. 

In the same time frame, Horeff [76] reviewed 382 substantial damage accidents and incidents to 
U.S. and foreign operators which were considered impact survivable, i.e., not all occupants were 
fatally injured. Of these, 37 had fatalities. There were 42 approach accidents, of which 22 were 
fatal. Fire occurred in 16 of the 22 fatal and 4 of the 20 nonfatal approach accidents. There were 
179 landing accidents, of which 4 were fatal. Fire occurred in 3 of the fatal and 35 of the non- 
fatal landing accidents. There were 56 takeoff accidents, of which 7 were fatal and involved fire, 
with all 95 deaths attributed to fire. Of the 37 occurring in flight, one aircraft experienced an in- 
flight fire followed by an off airport landing, resulting in 123 fatalities due to fire. In 19 cases, 
wing separation occurred. Fire accounted for over one-third of the deaths in these accidents. In 
15 cases, fuel tank damage occurred; 7 of the 15 were fatal and fire accounted for about 30% of 
the deaths. Fuel was released from tanks in 22 cases without fire. Seven fire accidents had 
reports of fuel line or engine fuel release; two were fatal and all 91 deaths were due to fire. 
There were 16 cases of fuel tank explosions, 4 from electrostatic sparks and 12 from heating due 
to external fires. Combining survivable and nonsurvivable fatal accidents during this time 
period, about 16% of the 2455 deaths were due to fire. 

Another report covering almost the same time period was produced by the NTSB in 1977 [77]. 
This was intended as a follow-on to reference 74 and reviews the changes in the air carrier 
business during the interim between reports. These changes included moving almost completely 
to a pressurized jet fleet with a better structural environment, better seat and restraint systems, 
greater use of kerosene and better engine fire extinguishing systems. The number of fire 
accidents decreased slightly (153 to 141) but the number of persons exposed to these accidents 
increased significantly, from 4559 to 7043, due to larger aircraft and high-load factors. In 
addition, the accident rate decreased while number of flights and seat-miles increased rapidly. 
Of greater significance to postcrash fire studies, the ratio of fatalities from all causes to the total 
number of occupants in fire accidents decreased from 43% to 26% during this period. This 
means an occupant had a 65% better chance of surviving the fire accident in the latter period 
compared to the former. In addition, an occupant who survived the impact had a 37% better 
chance of escaping the fire. However, due to higher passenger loads and thus increased numbers 
exposed in each accident, the total number of fire fatalities remained almost constant in the two 
periods, 297 compared to 292. The percentage of accidents to U.S. air carriers in all operations 
in which fire occurred increased from 18.6 to 25.3. 

Two factors were identified to account for the changes in fire accident data. Turbojet-powered 
aircraft accounted for an increasing percentage of all flights, with their greater reliability, 
structural integrity, changed operating environment and use of different fuel. Secondly, 
improved fire protection regulations, improved interior materials, and improved engine reliability 
reduced in-flight fires and their associated hazards. No change could be noted in the effect of 
increased availability of airport crash/fire/rescue on survivability between the periods. Most of 
the regulatory changes in this area were to take effect after 1975. 

In 1980, the NTSB published a Special Study “General Aviation Accidents: Postcrash Fires and 
How to Prevent or Control Them” [78]. In this study of 22,002 general aviation accidents during 
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1974 to 1978, they noted that postcrash fire occurred in 8% of the accidents and that 59% of 
postcrash fire accidents resulted in fatalities. They reviewed the history of postcrash fire 
prevention efforts, surveyed the state-of-the-art technology, and showed how the U.S. Army’s 
efforts had succeeded in reducing helicopter fire deaths by the application of the techniques in 
the Crash Survival Design Guide. They also reviewed the minimal regulatory provisions dealing 
with postcrash fire and made six recommendations to the FAA for corrective action. Some are 
applicable to transport aircraft. They were 

“Amend the airworthiness regulations to incorporate the latest technology for 
flexible, crash-resistant fuel lines and self-sealing frangible fuel line couplings at 
least equivalent in performance to those used in recent FAA tests and described in 
Report No. FAA-RD-78-28 for all newly certificated general aviation aircraft. 

• (Class II, Priority Action) (A-80-91 )” 

“Amend the airworthiness regulations to incorporate the latest technology for 
light weight, flexible crash-resistant fuel cells at least equivalent in performance 
to those used in recent FAA tests and described in Report No. FAA-RD-78-28 for 
newly certificated general aviation aircraft having nonintegral fuel tank designs. 

(Class II, Priority Action) (A-80-91)” 

“Require after a specified date that all newly manufactured general aviation 
aircraft comply with the amended airworthiness regulations regarding fuel system 
crashworthiness. (Class II, Priority Action) ( A-80-92)” 

“Fund research and development to develop the technology and promulgate 
standards for crash-resistant fuel systems for aircraft having integral fuel tank 
designs equivalent to the standards for those aircraft having nonintegral fuel tank 
designs. (Class II, Priority Action) (A-80-93)” 

“Assess the feasibility of requiring the installation of selected crash-resistant fuel 
system components, made available in kit form from manufacturers, in existing 
aircraft on a retrofit basis and promulgate appropriate regulations. (Class II, 

Priority Action) (A-80-94)” 

“Continue to fund research and development to advance the state-of-the-art with 
the view toward developing other means to reduce the incidence of postcrash fire 
in general aviation aircraft. (Class II, Priority Action) (A-80-95)” 

In the 20 years that followed, not one of these recommendations was implemented for fixed- 
» wing aircraft. The first two were partially implemented for helicopters in 14 CFR Parts 27 and 

29. 

The SAFER Committee (see section 2.3.4) recommended in 1980 that data collection and 
verification from actual accident investigations be improved to provide more robust validation 
for theoretical crash scenarios. The Committee repeated earlier recommendations by the 
Coordinating Research Council in its Report #482, titled “Aviation Fuel Safety - 1975.” 
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In the case of Air Carrier accidents, NTSB Form 6120.2 is used in reporting 
all civil aircraft accidents involving aircraft exceeding 12,500 pounds takeoff 
weight, helicopters and Alaskan air carriers. Usually this form is supported 
by attached statements as well as the report of the Investigation Team. 

Complete though this form is, it still lacks certain vital information relevant 
to fuel fires; unfortunately the usual attachments to this form in an Accident 
File also lack the information. A revision to the form should focus attention 
on the need for information relative to fuel and fires. [53] 

Form 6120.4 Sup. C now contains spaces for recording the fuel quantities in wing, tip, and 
fuselage tanks and some boxes to check regarding “spillsafe fittings” and fuel leakage. 
However, a review of structures reports of recent transport accidents reveals little specific data 
on fuel leakage locations, whether or not fuselage tanks were installed, the presence or absence 
of self-sealing valves, etc. This information is not stored in a usable computer database. 

Accidents are rare events, and accidents which inteiject postcrash fire-related hazards into 
otherwise survivable circumstances are even more rare. Investigative authorities’ inability to 
extract all available data and information from these infrequent occurrences has inhibited 
identification of real risks in real events. Unfortunately the SAFER Committee chose to 
prioritize high-cost, high-risk AMK research in preference to pursuing relatively low-cost, low- 
risk methodologies which would validate and verify the data upon which such choices were 
made. The SAFER Committee thereby violated its own caveat memorialized in its final report 
[53]: 


Adequacy of Aircraft Accident Data 

A sound plan of attack on any safety problem must start with a careful analysis of 
the accident data in order to pinpoint the true causes of accidents and identify 
effective remedies. Otherwise, we may devote large amounts of limited resources 
to solving the wrong problem. 

One of the more recent detailed accident studies was reported by Boeing Commercial Airplane 
Company in 1982 in preparation for the Controlled Impact Demonstration (CID) [79]. This 
excellent study by Widmayer and Brende reviewed publicly available and company data and 
tabulated detailed information from 153 “potentially survivable” accidents drawn from an initial 
database of 583 accidents occurring from 1959 to 1979. 

While fire occurred in 67% of the report’s cases and fatalities due to fire in 37%, this database 
does not represent all kinds of accidents, only those during the selected period wherein good data 
could be derived to support the selection of crashworthiness improvements “or that demonstrated 
significant crash performance of the structure.” The authors of this report are unable, during the 
current study, to obtain the same depth of data on later accidents because internal company data 
is not publicly available, we have provided a listing of selected accidents subsequent to 1979 that 
support the findings of the Boeing study (table 4-1) and show that the problems of postcrash fire 
have not been solved. 
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TABLE 4-1. SELECTED ACCIDENTS WITH FIRE, SHOWING IMPACT AND FERE DEATHS 


Event 

Fire Data 

Date 

Aircraft 

Location 

Dead 

Serious 

M/N 

Total 

Impact 

Fire 

Abort T/O 

Gear tearout, major fire 

780301 

DC-10 

LAX 

2 

29 

169 

200 

0 

2 

Gear Up Ldg 

Destroyed by fire 

810217 

B-737-293 

ORANGE CTY 

0 

4 

106 

110 

0 

0 

In Fit Fire 

Cabin flash fire 60-90 sec after stopping 

830602 

DC-9-32 

COVINGTON 

23 

3 

20 

46 

0 

23 

Takeoff Coll, Overrun 

Both wings damaged 

831223 

DC-10/PA-31 

ANCHORAGE 

0 

3 

9 

12 

0 

0 

Coll Gnd, Cont. Rolled 

Wing tanks ruptured 

850121 

L-188 

RENO 

70 

1 

0 

71 

43 

27 

Landing, Wx 

Major destruction, fire 

850802 

L-101 1-385 

DFW 

134 

15 

14 

163 

114 

20 

Ldg Hard, Slid Into Bldg 

Major destruction of wings 

870304 

C-212 

DETROIT 

9 

7 

6 

22 

0 

9 

T/O Coll Gnd, Controlled 

Wing struck pole, bldg, ground 

870816 

DC-9 

DETROIT 

154 

1 

0 

155 

154 

0 

T/O Coll Gnd Uncontrolled 

Icing, lost lift. Short fireball inside 

871115 

DC-9 

DENVER 

28 

24 

30 

82 

28 

0 

Inflt Fire, Ldg No Hyd. 

Engine fire, rapid CFR response 

880415 

DHC-8-102 

SEATTLE 

0 

4 

36 

40 

0 

0 

Eng Fail On T/O, Overrun 

Fire in cargo area 

880524 

EMB-110 

LAWTON 

0 

2 

6 

8 

0 

0 

T/O Improper Config 

Fire before stopping 

880831 

B-727-200 

DFW 

14 

26 

68 

108 

0 

14 

Landing, Uncontrolled 

Major destruction, fire 

890719 

DC-10-10 

SIOUX CITY 

111 

185 

0 

296 

76 

35 

Gnd Coll 

B-727 wing sliced DC9 fuselage 

901203 

DC-9- 14 

ROMULUS 

8 

10 

26 

44 

3 

5 

Coll/W Commuter, Landing 

Major fire 

910201 

B-737/SA227 

LAX 

22 

10 

48 

80 

1 

21 

T/O, Uncontr. Coll Gnd 

Lt wing destroyed, fire in aft fuselage 

910217 

DC-9-15 

CLEVELAND 

2 

0 

0 

2 

2 

0 

Abort T/O Gear Off 

Eng. Tom off, destroyed by fire 

910312 

DC-8-62 

JFK 

0 



5 

0 

0 

Uncont Eng, Abort T/O 

Fuel line cut, destroyed by fire 

910503 

B-727-100 

BRADLEY FLD 

0 

0 

3 

3 

0 

0 

Abort T/O, Hard Ldg 

Rear spar crack ruptured tank 

920730 

L-101 1 

JFK 

0 

1 

291 

292 

0 

0 

Miss Approach, Cfit 

Wing separation, immediate fire 

940702 

DC-9-31 

CHARLOTTE 

37 

16 

4 

57 

32 

5 1 

Uncont. Eng, Cut Fuel Line 

Spread quickly, destroyed by fire 

950608 

DC -9-32 

ATLANTA 

0 

1 

61 

62 

0 

0 

Prop Fail Off Airport Ldg 

Major damage and fire 

950821 

EMB-120 

CARROLLTON 

8 

13 

8 

29 

0 

8 

Gear Up Ldg 

Small fire cargo area, smoke in cabin 

960219 

DC-9-32 

HOUSTON 

0 

0 

87 

87 

0 

0 

Collision On Landing 

Major fire, unable to open door 

961119 

BE-1900 

QUINCY 

14 

0 

0 

14 

0 

14 

Hard Ldg, Rmg Collapse 

Rt wing sep, a/c inverted 

970731 

MD-11 

NEWARK 

0 

0 

5 

5 

0 

0 

Cfit On Approach 

Major fire, total destruction 

970806 

B-747-300 

GUAM 

228 

26 

0 

254 

0 


T/O Coll Gnd Controlled 

Broke up, destroyed by fire 

970807 

DC-8-61 

MIAMI 

3 

0 

0 

3 

0 


Aft Cg, Settled, Hard Ldg 

Gear collapse, fuel leak, fire 

970813 

BE-1900C 

SEATTLE 

0 

1 

0 

1 

6 

0 

Taxi Coll, Eng Separation 

Fuel lines broke, nacelle/fuselage fire 

981025 

ATR-42-300 

SAN JUAN 

0 

0 

27 

27 

Impact 

0 

Overrun 

Wing off, fire in swampy area 

990601 

MD-82 

LITTLE ROCK 

11 

45 

89 

145 

0 

5 


NOTH: The last two columns are deaths due to impact and fire. 



In the review of fire hazards, specifically noted were the breaking of fuselage fuel lines to aft 
engines and APUs, wing/pylon separation due to ground or barrier contact and inertial loads, and 
wing fuel tank rupture. Fire was present in 103 accidents and fuel spilled without fire in 22 
accidents. The authors of the Boeing study stated that the greatest potential for improved 
survivability is in the area of fire-related fatalities. 

This Boeing report contains many comments and recommendations for additional 
crashworthiness research and development, including improvements in the technology, better 
data collection at accident sites by properly trained teams of crashworthiness investigators, 
greater use and improvement in computer simulation programs, maintaining and updating testing 
facilities, additional complete aircraft testing, and research into advanced crashworthiness 
concepts. It is significant to note that in the year 2000 there are no properly trained teams of 
crash fire investigators for civil transport accidents, the NASA impact test facility is being 
considered for disassembly, and no full-scale crash tests of transport aircraft have been done 
since the CID in 1984. 

The report’s data was used to establish a range of crash situations that could provide a basis for 
developing improved crashworthiness design technologies. This report is probably still the best 
current study of impact scenarios available and should still be used for design studies. 

In addition to the Boeing study, Lockheed and McDonnell Douglas were also contracted for 
similar work. The three reports are summarized in a joint NASA/FAA report [54], Thomson 
and Caiafa combined the databases from the three studies and established candidate accident 
scenarios for future testing. They also “...determined that the most critical event in the crash 
sequence that caused most fatalities was the release and ignition of fuel creating a fire hazard.” 

Thomson and Caiafa recommended specific research areas for the greatest potential reduction in 
fire fatalities and injuries. They are 

• Fuel Containment . Increased resistance to tears, ruptures, and punctures. Designing 
failure points on wing box structures with double-wall tanks at these points. Reduction 
of the potential for tank explosion using flame arrestor media. Designing fuel 
transfer/feed lines more resistant to failure and automatic shutoff of fuel flow. 

• Tank Rupture . Effects of main gear collapse on tank, including wing contact with ground 
tearing lower surface. Engine separation and tumbling under wing causing penetration. 
Fuel spill and electrical arcs at engine/pylon separation. 

• Fuel Characteristics . Antimisting fuels and gelled fuels research to continue. 

An additional area they covered was floor disruption causing increased trauma injuries. This can 
be caused by auxiliary fuel tanks in the cargo compartment delivering impact loads from the 
lower skin directly to the floor beams. This has been noted in test drops (section 3) and is an 
area of concern in the design of range extension fuel storage. 

None of the above areas have been addressed by regulatory changes to 14 CFR Part 25. 
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Frank Taylor of the Cranfield Aviation Safety Centre in the UK has studied the transport fire 
problem for many years and has produced many excellent reports on the subject (see references 
80, 81, 82, and 83). 

Mr. Taylor’s data indicates that, worldwide in the mid-1990s, there were approximately 600 
people killed annually in survivable accidents and about 800 in nonsurvivable accidents. Earlier 
data had indicated that about 45 percent of the fatalities in survivable accidents were due to fire, 
but the most recent study reported that cause of death data was available in too few accidents to 
make any accurate estimate of fire deaths. He also points out in his conclusions in reference 82 
that “The overall safety record is sufficiently good to make it very unlikely that any particular 
safety feature will appear to be cost-effective. Consequently, if progress is to be made, a new 
way is needed of dealing with such safety features.” “Emphasis should be placed on minimizing 
the disbenefits of potential safety features in order to optimize the net benefit.” 

Mr. Taylor has also suggested some recommended action areas for postcrash fire prevention. 
Among them are: 

• External camera(s) and cockpit monitor 

• Cabin water mist system 

• Less flammable fuels 

• Passenger smoke hoods 

• Fuel tank and fuselage integrity following undercarriage collapse, etc. 

• Greater protection of fuel/hydraulic lines passing through the fuselage 

• Onboard extinguishing systems in equipment bays 

4.3 SPECIFIC ACCIDENTS . 

In 1985, a British B-737 in the U.K. was involved in a fire during the takeoff roll when an engine 
failure led to a rupture of a fuel tank access cover. A large fire began before the aircraft came to 
a halt. All injuries and fatalities were due to fire. The British report of this accident contains 
many recommendations regarding the minimization of fire hazards, and this led to many changes 
in the standards for interior materials and improved tank cover plate requirements. 

The following recommendations were made in that report that relate to this study. (There were 
other recommendations regarding firefighting, etc., that are not included herein.) 

4.2 Research should be undertaken into methods of providing the flight deck 
crew with an external view of the aircraft, enabling them to assess the 
nature and extent of external damage and fires. 

4.5 Emergency equipment for use by cabin crew during an emergency 
evacuation should be stowed at the cabin crew stations. 

4.10 A review of the approval of the cabin configuration as it existed on 
G-BGJL should be conducted, with particular reference to the following 
features of that configuration: 
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i) The restricted view of the passenger cabin afforded the forward 
cabin crew when seated. 

ii) The forward aisle restriction created by the floor to ceiling forward 
galleys. 

iii) Access to the overwing exit where the presence of row 10 seats 
appeared to conflict with the British Civil Airworthiness 
Requirements. It is recommended that all row 10 seats be removed. 

The approval of other configurations on Boeing 737 and other types should also be 

reviewed with the intention of addressing any similar problems. 

4.1 1 A review should be conducted to examine the adequacy of existing British 
Civil Airworthiness Requirements relating to 'unobstructed access' to exits 
and these updated where necessary to take account of modem high density 
seating configurations. 

4.18 A thorough review should be undertaken into techniques for extinguishing 
fires inside the passenger cabins of public transport aircraft, with a view to 
rectifying the current deficiencies in airfield firefighting capability when 
dealing with internal fires. 

4.19 Onboard water spray/mist fire extinguishing systems having the capability 
of operating both from on-board water and from tender-fed water should 
be developed as a matter of urgency and introduced at the earliest 
opportunity on all commercial passenger carrying aircraft. 

4.20 The balance of effort in aircraft fire research should be restored by 
increased effort directed towards fire hardening of the hull, the limitation 
of fire transmission through the structure and the prevention of structural 
collapse in critical areas. Short term measures should be devised for 
application to existing types but, in the long term, fire criteria should form 
a part of international airworthiness requirements. 

4.21 A requirement should be introduced to ensure that existing external fuel 
tank access panels which are vulnerable to impact from engine or 
wheel/tire failures on aircraft in service are at least as impact resistant as 
the surrounding structure. The potential risk of damage from debris 
impacts should be addressed in future by appropriate design requirements 
covering debris ejection from engines and/or impact strength requirements 
for the airframe. 

4.24 The Civil Aviation Authority should urgently give consideration to the 
formulation of a requirement for the provision of smokehoods/masks to 
afford passengers an effective level of protection during fires which 
produce a toxic environment within the aircraft cabin. 
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4.25 The proposed requirement for cabin crew smokehood protection be 
extended to include training for crew donning and use during aircraft 
emergency evacuations associated with a fire and/or smoke threat during 
the evacuation. 

4.26 The applicable regulatory requirements for aircraft cabin materials 
certification should be amended at the earliest opportunity to include strict 
limitations of smoke and toxic/irritant gas emissions. 

4.27 A research program should be undertaken to establish the effect of water 
mist/spray extinguishing systems on the toxic/irritant constituents of fire 
atmospheres. 

4.28 The existing regulatory requirements governing the Evacuation 
Certification of public transport aircraft should be reviewed and amended 
to include: 

i) A demonstration of an acceptable evacuation time when the cabin is 
evacuated using half the total number of exits, disposed towards one 
end of the cabin; that end being chosen which represents the greatest 
restriction to passenger egress. 

ii) Simulation of a defined dense smoke atmosphere within the cabin, 
existent from the initiation of the evacuation until its completion. 

iii) All other sub-testing associated with cabin evacuation, including 
passenger aisle flow, the identification of exits and aperture egress 
rates, upon which design and configuration certification decisions 
are based, be conducted in the same simulated smoke atmosphere. 

In the 1 5 years since this accident, only a few of these items have been adequately addressed. 

Recent accidents with fire significance: 

• Kegworth, Leicestershire, U.K., B737-400, Jan. 8, 1989 

The aircraft was flown into the ground with both engines off. The fuselage broke into 
three sections, with the nose section going up an embankment. The center section, with 
wings, remained upright. The aft section broke off aft of the wing trailing edge and 
buckled to the right. All the landing gear broke off at their design separation points; both 
engine pylons separated at points different than their design points; and wing leading 
edges were damaged by trees. No fuel tanks were ruptured. A fire occurred at the left 
engine and was burning after impact. It began to flare up just as fire fighters arrived and 
extinguished it. There was a very rapid response due to early notification of the 
impending emergency. Of the 126 persons onboard, 47 died of impact injuries. Many 
more were trapped and injured and would have died had there been a significant 
postimpact fire. 


4-9 



Carrollton, GA, Atlantic Southeast Airlines, EMB-120RT, August 21, 1995 


The loss of a propeller blade in flight resulted in a forced landing off airport. The aircraft 
broke up, 3 of the 4 wing fuel tanks were ruptured and a severe fire began about 1 minute 
after the aircraft came to a stop. Electrical arcing sounds were heard by the survivors. 
The fire involved the forward cabin, killing seven passengers and the captain. The first 
officer tried to hack open his side window with a fire axe but was unable to do so, and the 
wooden axe handle was broken during the attempt. He was rescued by crash/fire/rescue 
personnel after the cabin fire was extinguished. 

Some passengers reported their clothes were saturated with fuel. There was no analysis 
of how this occurred, or of any fuel lines that may have been broken in the cabin or 
center wing area. 

The only recommendation regarding fire issues was to study the function of the fire axe 
and provide a Technical Standard Order (TSO) as necessary. 

East Grandby, CT, American Airlines, MD-83, November 12, 1995 

This aircraft hit trees on a ridge prior to landing short in the localizer antenna area, 
ending up on the runway. There was no fire damage to the fuselage but some minor fire 
evidence in the right engine. No fuel leaks were reported but hydraulic lines in the 
landing gear area were broken. There was no analysis of how severe these leaks were or 
why there was no fire. 

LaGuardia Airport, NY, Delta Air Lines, MD-88, October 19, 1996 

This aircraft landed short in the approach light area, the main landing gear separated and 
it skidded along the runway. A fuel leak was noted due to a puncture in the right wing 
tank, causing the loss of about 600 gallons of fuel. There was no fire. There was no 
analysis of why there was no fire nor of hydraulic leaks associated with the loss of the 
landing gear. 

Quincy, IL, United Express Airlines, Beech 1900C and Beech A90 collision on runway, 
Nov. 19, 1996 

In this accident, the impact forces were at a survivable level and all persons onboard both 
aircraft were killed by the fire which began immediately upon contact. There was no 
firefighting staff at the airport at the time of the accident, but rescue attempts began 
almost immediately. The airstair door of the 1900 was jammed so that witnesses who 
arrived at the aircraft while the pilot was still alive could not open it. There are 
recommendations in the report regarding door jamming and airport firefighting 
capabilities, but nothing on fire prevention or crashworthiness. 



Newark, NJ, Federal Express, MD-1 1, July 31, 1997 


This aircraft experienced a hard landing, causing the right main landing gear to fail 
upwards, fracturing the right wing. Fire evidence began along the runway about 2000 
feet from the wreckage. The aircraft rolled almost inverted after the wing failure. All 
three engines were separated from the airframe, but no details are provided as to where or 
how any fuel and hydraulic lines separated or released fluid. 

The fire section of the report states, in its entirety 

“A fuel-fed fire erupted on impact.” 

The crash/fire/rescue crew reported that as they approached the aircraft flames were 
venting from the aft section of the fuselage. There is no information as to the source of 
fuel in that area. Although the right wing tank was compromised and may have provided 
most of the fuel for the fire, the line to the aft engine and auxiliary power unit (APU) also 
was broken but no details are provided that would help locate a self-sealing fitting in an 
appropriate location. 

There were no recommendations regarding fire safety in this report. 

Guam, Korean Air, B-747, August 6, 1997 

In this accident, a Controlled Flight Into Terrain (CFIT) accident, there were 26 survivors 
of the 254 persons onboard. The report (NTSB/AAR-00/01) does not give the cause of 
death information needed to separate the trauma deaths from thermal deaths, but the 
impact into a hill severely damaged the aircraft, probably rupturing all fuel tanks, and 
there was a large fire. Some survivors were burned, and one reported that a “ball of 
flame was going down the center of the airplane” and that passengers were screaming and 
calling for help (NTSB report, page 45). There were no recommendations in this report 
regarding fire protection or prevention. 

Miami, FL, Fine Airlines, DC-8-61, August 7, 1997 

This aircraft was out of trim on takeoff and had an uncontrolled impact with the terrain 
beyond the end of the runway. All four engines struck the ground and separated from the 
pylons, but no details are provided as to fluid line separations. The airframe was 
extensively damaged and much was consumed by fire. 

The fire section of the report states, in its entirety 

“A fuel-fed fire erupted on impact.” 



Little Rock, AR, American Airlines, MD-82, June 1, 1999 




In this overrun accident, the aircraft departed the end of the runway and impacted the 
approach light structures while going down a rocky berm to the river level, separating the 
fuselage into three sections and driving metal bars into the fuselage in several places. 
The left side of the first class section was tom off and the seats on that side were ejected. 
There were 11 fatalities (six from trauma and five from fire) among the 145 persons 
onboard. Fire broke out over the center section tank where the fuselage had separated, 
and survivors exited both forward and aft of that point. Fire ultimately consumed the 
upper fuselage aft of the wing leading edge. The left wing was severely damaged and 
separated near the root and near the tip. The center section tank was tom open and all the 
fuel drained out, but the right wing retained its 1000 gallons of fuel. The structures report 
does not discuss the fuel lines in the fuselage leading to the aft engines. A final report of 
this accident has not yet been issued, so there are no detailed conclusions or 
recommendations regarding fire in this accident. 

In all of the above reports, there is not enough data to determine whether the installation of 
frangible self-sealing fittings would have made a difference in the fire situation. There is not 
enough data on fuel tank failures to give designers information on how those failures might be 
prevented. There is no mention of auxiliary fuel tanks, whether they were installed or not, and if 
installed, whether they contributed to the fire. 

The recommendations of the SAFER committee (1980) and the Boeing study (1982) for better 
accident investigation data have not been followed. The NTSB has not made any significant 
recommendations on fire prevention in the above accidents. While survival factors get attention, 
and have their own section in the NTSB investigation, fire prevention and detailed fire analysis 
do not. 
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5. CURRENT FUEL SYSTEMS. 




5.1 AIRFRAME DESIGN CATEGORIES . 

Transport aircraft certified under 14 CFR Part 25 include all aircraft over 12,500 lbs plus jet- 
powered aircraft of any weight. Many aircraft models operate at a variety of weights and fuel 
tank configurations, depending on specific model, so there may be some overlap in the following 
subdivisions which are established for use in this report: 


Category Description 

A Under 60,000 #, all engines on the wings 

A.l High wing, all engines on the wings (ex. DHC7 and 8) 

A.2 Low wing, all engines on the wings (ex. BE 1900) 

A. 3 Low wing, engines on aft fuselage (ex. Bombardier CL600) 

B 61,000 to 100,000# 

B. l High wing, all engines on the wings (ex. BA146) 

B.2 Low wing, all engines on the wings 

B.3 Low wing, engines on aft fuselage (ex. ERJ145, F28) 


C Over 100,000#, all low wing 

C.l All engines on wing (ex. B737, B747, Bill) 

C.2 All engines on aft fuselage (ex. MD81, B717, B727) 

C.3 Engines on wing and aft fuselage/tail (ex. LI 01 1, MD1 1) 


Table 5-1 lists many, but not all, current aircraft with their approximate takeoff gross weight, 
type of engine, wing configuration, location of manufacturing. It must be noted that this is a 
time of rapid expansion of air carrier fleets, especially in the regional markets. New and 
derivative aircraft are being announced almost monthly. Some aircraft models are being 
stretched with attendant gross weight increases, so that the classes outlined herein are very 
arbitrary and some aircraft types may overlap categories. 

5.2 FUEL SYSTEM DESIGNS. 


In a study prepared in 1982 for the AMK program, commercial aircraft fuel systems were 
reviewed for potential component problems using gelled fuels. This report [84] contains detailed 
diagrams of many typical (basic) fuel systems, including line sizes, types and locations of 
pumps, check valves, and vent and scavenge systems. 

Detailed data of this type will not be repeated herein, as systems can vary even within specific 
models of aircraft depending on customer configurations, engine choices, and addition of 
auxiliary tanks. However, the basic concepts of fuel storage and distribution are similar in all 
aircraft. 
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TABLE 5-1. CURRENT AIRCRAFT 


Aircraft 

Max Weight 

Engine 

Wing 

Mfg. 

EMB110 

12500 

TP 

L 

B 

D228-212 

14110 

TP 

H 

E 

J31 

15212 

TP 

L 

E 

BE1900D 

16950 

TP 

L 

U 

SH330 

22000 

TP 

H 

E 

NORD262A 

23490 

TP 

H 

E 

SA227-III 

24500 

TP 

L 

U 

EMB120ER 

26600 

TP 

L 

B 

SH360-300 

27000 

TP 

H 

E 

S340B 

28800 

TP 

L 

E 

D328 

30842 

TP 

H 

E 

ATR42-500 

41005 

TP 

H 

E 

DHC7 

44000 

TP 

H 

C 

EMB145ER 

45414 

J 

L 

B 

FOKKER 50 

45900 

TP 

H 

E 

HS748-2A 

46500 

TP 

L 

E 

ATR72-212 

49603 

TP 

H 

E 

SA2000 

50260 

TP 

L 

E 

ATP 

50550 

J 

H 

E 

CRJ200 

51000 

J 

L 

C 

DHC8Q400 

63750 

TP 

H 

C 

F28-4000 

75240 

J 

L 

E 

CRJ700 

82500 

J 

L 

C 

BAE146-200 

93000 

J 

H 

E 

F28-0100/FOKKER 100 

101500 

J 

L 

E 

B737-200 

117000 

J 

L 

U 

B7 17-200 

121000 

J 

L 

U 

A3 18 

145200 

J 

L 

E 

MD82 

149500 

J 

L 

U 

B737-700 

153000 

J 

L 

u 

DC9-88 

160000 

J 

L 

u 

A320/3 19/321 

169000 

J 

L 

E 

B737-800 

172500 

J 

L 

U 

B727-200 

209500 

J 

L 

U 

B757-200 

220000 

J 

L 

U 

B720 

234000 

J 

L 

U 

B707 

335000 

J 

L 

U 

A3 10 

346125 

J 

L 

E 

DC8-63 

355000 

J 

L 

U 

A300 

370000 

J 

L 

E 

B767-300 

380000 

J 

L 

U 

CONCORDE 

408000 

J 

L 

E 

A330 

467000 

J 

L 

E 

L101 1-500 

510000 

J 

L 

U 

A340 

553360 

J 

L 

E 

DC 10-30 

580000 

J 

L 

U 

MDll 

625000 

J 

L 

u 

B777-300 

660000 

J 

L 

u 

B747-200 

805000 

J 

L 

u 

B 747-400 

875000 

J 

L 

u 


ENGINE 

WING 

MFG 

= Turbo Prop 

H = High 

B = Brazil 

J = Jet 

M = Mid 

C = Canada 


L - Low 

E - Europe 



C 

II 

c 

OO 
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In general, aircraft of all the above types carry fuel in wing tanks, usually integral to the 
structure. (See figures 5-1, 5-2, and 5-3 for examples of integral wing tank spaces which have 
been cut open during the process of scrapping the airframe.) In addition, center tanks are used in 
low-wing aircraft in many cases. Some of these are integral (see figure 5-4 for the aft half of a 
large aircraft center tank that has been cut open and figure 5-5 for another view of a center tank 
and wing root fuel spaces) and some have bladder liners (see figure 5-6 for a view of a center 
tank with openings to the bladders, figure 5-7 for a view inside the bladder compartment, and 
figure 5-8 showing the aft compartment with a tom bladder). Some high-wing aircraft carry fuel 
in fuselage tanks over the passenger compartment, rather than in the wings. Figure 5-9 shows 
this type of tank after a drop test at the FAA test center. The tanks have moved downward into 
the passenger space and both the forward and aft tanks leaked heavily after a vertical impact 
which was otherwise survivable. Figure 5-10 shows the bottom of the aft tank with all fuel 
« fittings broken. (This test is discussed in section 3.1.) 

In addition to the above configurations, many aircraft have additional tank capacity in the form 
of fuselage tanks in the forward and/or aft lower baggage areas or in the main cabin area in some 
cargo and mixed configurations. Most of these are removable auxiliary tanks. Figure 5-11 
shows a typical underfloor auxiliary tank as installed for a test at the FAA test center. It is 
suspended from the main cabin floor and restrained at the bottom from fore/aft movement. It is 
removable when necessary. This tank leaked fuel after a drop test representing a survivable 
accident (see section 3.1). Some aircraft may carry as many as five auxiliary tanks in various 
locations. 

In some later model large aircraft (Category C), fuel is stored in integral tanks in the horizontal 
tailplane. This provides additional fuel capacity and the ability to adjust the center of gravity for 
lower trim drag during cruise. 

Fuel distribution systems for aircraft with all engines on the wings have little or no fuel plumbing 
in the fuselage except for the center of the wing area. In some aircraft with a dry center bay area, 
there are large fuel lines through this area between the wings. There may be a line to an 
auxiliary power unit (APU) in some other part of the aircraft, such as the tail or landing gear 
well. There may also be a pressure refueling line located somewhere lower in the fuselage for 
high-wing aircraft. Aircraft with engines on the aft fuselage or in the tail (Categories A.3, B.3, 
C.2, and C.3) all have fuel lines that typically are routed under the floor of the main cabin from 
the wing area to the aft fuselage. These lines can be several inches in diameter and contain 
considerable quantities of fuel at all times. Lines in the pressurized area are shrouded and the 
shrouds are drained to a safe area. See figure 5-12 for an example of two shrouded fuel lines 
coming out from below the main cabin floor in the tail cone and routing to two aft-mounted 
engines. 
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FIGURE 5-1. WING TANK IN ROOT AREA 



FIGURE 5-2. WING TANKS CUT OPEN 
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FIGURE 5-3. WING TANK CUT OPEN 


FIGURE 5-4. CENTER SECTION FUEL TANK WITH CABIN FLOOR 

ABOVE— REAR VIEW 

J 
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FIGURE 5-7. INSIDE CENTER SECTION BLADDER TANK 



FIGURE 5-8. CUT OPEN CENTER SECTION BLADDER TANK SHOWING 

SUPPORT LACING 
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FIGURE 5-9. FUSELAGE FUEL TANKS OVER PASSENGER COMPARTMENT 

AFTER DROP TEST 



FIGURE 5-10. BOTTOM VIEW OF FUSELAGE TANK (FROM FIGURE 5-9) SHOWING 

FOUR FUEL FITTINGS TORN FROM TANK 
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FIGURE 5-11. AUXILIARY FUEL TANK IN BAGGAGE AREA UNDER CABIN 

FLOOR PRIOR TO DROP TEST 

These two fuel lines are routed aft through the fuselage through holes in the floor beams of this 
aircraft. If the floor is disrupted, the lines will likely break because they cannot displace and 
stretch. In another transport airplane design, the lines are suspended below the floor beams. The 
designer of that system reports that the lines were tested by forcing them transversely all the way 
across the aircraft by a ram. They stretched and necked down, but did not leak. 

Self-sealing breakaway valves are rarely used in transport aircraft although they have been 
available for 40 years. The valves are sometimes used in auxiliary fuel systems, such as fuselage 
tanks. However, this research effort could not find any instances where they are (or were) 
installed in primary fuel systems, even in areas of known separation such as designed overload 
disconnection points in engine pylons. 
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FIGURE 5-12. SHROUDED FUEL LINES FROM UNDER CABIN FLOOR 

INTO AFT FUSELAGE 

Authors of the 1988 FAA report to Congress included the following statement as their principal 
argument against employing self-sealing breakaway valves in airplanes’ primary fuel systems: 

It may be noted that breakaway fittings are used in the fuselage auxiliary fuel 
system installations of some current narrow-body transport airplanes, but were 
removed from an installation in a wide-body airplane after a fitting closed 
inadvertently on the ground due to fuel system structural deflections . [52] 
(underline added) 
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The underlined portion of the statement is false. This easily verifiable misinformation has been 
accepted uncritically for many years. Recent discussions with the fuel system engineer actually 
involved in the test revealed that, in fact, the fuel line which was to have been connected to the 
valve was too short, and the mechanic installing it stretched it attempting to force the installation. 
The valve broke due to excessive tension on the overloaded line. Management then decreed that 
the valve be removed rather than take the time to redesign its installation properly. 

NPRM 85-7 A proposed revising standards for Crash-Resistant Fuel Systems in 14 CFR Part 23 
airplanes. An aircraft engineering consultant — an FAA-Designated Engineering Representative 
(DER) — submitted comments in a letter dated Oct. 17, 1989, stating he had “...completed a 
study of the failure probability of the breakaway valves used on the U.S. Army’s UH-1 series 
helicopter. It was determined that the average failure rate of these components was 2.17 x 10.” 
This misrepresentation was originally created for use in general aviation product liability 
litigation involving crashworthiness issues. It was derived from U.S. Army spare parts order 
data, which the commenter alleged to be replacements for failed items, and not from any 
reported failure data. In fact, no U.S. Army accident has ever been traced to inadvertent closure 
of a breakaway valve. 

False allegations, such as these two examples, could easily have been refuted by minimal 
research. Instead, they were uncritically accepted as facts and included in official documents, 
fueling fears of unreliability which have been used to oppose consideration of the valves’ use in 
primary fuel systems. Indeed, there has never been a significant problem documented from 
using properly installed breakaway valves in U.S. Army or transport aircraft. 

Typical fuel usage patterns are to keep fuel in the inner part of the wings as long as possible in 
order to reduce wing bending moments. In some cases fuel is moved forward or aft to adjust 
center of gravity for cruise efficiency purposes. Auxiliary tanks are usually pumped into main 
tanks after some main tank fuel is used. Accidents occurring on or shortly after takeoff often 
have fuel in all tanks, while accidents occurring on landing may have many empty or nearly 
empty tanks, some holding hazardous quantities of fuel vapor. Wing tanks will always have fuel 
in them on landing (except for fuel exhaustion accidents) and will often be the source of spilled 
fuel. Some operators carry extra fuel to avoid refueling at locations where fuel is short or very 
expensive, so some landing accidents may occur with much higher quantities of fuel than others. 

Aircraft in Category A have thinner skins in the wings than larger aircraft and, thus, are more 
likely to be damaged on impact. Some of these aircraft also have bladders in some tanks, 
depending on location in the aircraft. To the knowledge of the authors of this report, there are no 
cases in which the bladders are of a crash-resistant qualified material, rather, they are only liquid 
barriers of the thinnest usable material. Some of these aircraft are high-wing types, reducing the 
likelihood of engine tear-off or wing drag, although in one FAA drop test an engine broke off 
and the wings broke downward at survivable impact levels. Some high-wing aircraft have 
pressure refueling connections on the landing gear fairing. 

Aircraft in Category B have stronger wing skins than Category A aircraft, but also carry larger 
amounts of fuel in the wings. As wing design becomes more complex, for example, with 
leading- and trailing-edge lift devices, the simple box structure of the wing tank space is made 
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more complicated. For example, Figure 5-13 shows boxlike structures from a wing-forward spar 
web back into the fuel space to permit the leading-edge devices to retract into the fuel storage 
area. Figure 5-14 shows the same area from the front of the wing spar. This complex structure 
increases the likelihood of compromising the tank during accidents if the leading-edge devices 
are pushed back into the wing irregularly. 



FIGURE 5-13. POCKET INTO FORWARD WALL OF WING TANK TO ALLOW 
LEADING-EDGE DEVICE RETRACTION 



FIGURE 5-14. LEADING-EDGE DEVICE RETRACTING INTO POCKET IN 

WING FUEL TANK 

Category C aircraft have the strongest skins and wing structure and, therefore, are more likely to 
remain intact during survivable accidents, but in partially survivable crashes, they also have the 
most fuel and are likely to have the most passengers, making the risks of postcrash fire more 
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significant. The use of tailplane fuel tanks in this category also provides the potential of 
spraying fuel down on the wreckage during the accident sequence if the horizontal tail is 
impacted or over-stressed during the event. Some of these aircraft have a dry center wing 
section with fuel lines crossing between the wings. 

One of the many important aspects of preventing fuel leaks in survivable accidents is to prevent 
fuel leakage when the landing gear is tom off during the impact sequence. This has happened 
often in the past [79]. Many times fires have occurred, even though 14 CFR Part 25.721 requires 
that gear failure not release hazardous quantities of fuel. In addition, 14 CFR Part 25.994 
requires protection of the fuel system in wheels-up landings. 

Most transport aircraft use pressure-feed systems where pumps in the tanks deliver fuel to the 
engines under pressure. This is especially common in low-wing aircraft. Some systems use 
suction-feed and/or gravity-feed systems. This means that, in most accident situations, there will 
be pressurized fuel lines in various locations in the aircraft. It also requires wiring to the pumps, 
which is often routed through sealed plumbing lines within the tank. Figure 5-15 shows the 
routing of fuel pump wiring inside an integral tank and figure 5-16 shows the same area on the 
other side of the tank wall. Figure 5-17 is a pump in an integral wing tank. Since the pumps 
need to be on the bottom of the tanks, they are in vulnerable locations for impact with the 
ground. (See figure 5-18 for a pump compartment, and figure 5-19 for a lower wing surface with 
openings for pumps and access ports.) 

Fuel quantity measuring systems are always needed, and some systems use exposed wiring 
inside the tanks (see figure 5-20). 



FIGURE 5-15. ELECTRICAL AND PRESSURE LINES FOR FUEL PUMP 

INSIDE TANK WALL 
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FIGURE 5-16. OUTSIDE FUEL TANK WALL FROM FIGURE 5-15 SHOWING 
ELECTRICAL CONNECTION AND PRESSURE TRANSDUCER 


FIGURE 5-17. FUEL PUMP AND WIRING INSIDE WING ROOT TANK 
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FIGURE 5-18. ACCESS FROM WING LOWER SURFACE TO FUEL PUMP CAVITY 



FIGURE 5-19. WING LOWER SURFACE WITH PUMP OPENINGS AND 

ACCESS OPENINGS 



FIGURE 5-20. FUEL QUANTITY SENSOR AND WIRING INSIDE WING FUEL TANK 
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The above information is not new to aircraft designers or certification personnel. It is provided 
to set the context for discussions to follow. Categories of aircraft established by the authors of 
this report are arbitrary, but provide a starting place for discussions of what is possible in CRFS 
design. 

5.3 DESIGN CONSIDERATIONS . 

5.3.1 Wing Tank Disruption . 

It is clear from airplane crash tests (DC-7, L-1649, and CID) and from accident data that the 
wings of large transport aircraft can be totally destroyed and/or tom from the fuselage without 
any significant forces being felt by occupants of the aircraft. It is therefore irrelevant to discuss 
crash protection of wing fuel tanks in terms of G forces felt by the occupants. Much previous 
research has looked at various approaches to wing tank protection, such as bladders and 
individual tanks. In the case of aircraft larger than Category A aircraft, current state-of-the-art 
knowledge does not offer a practical solution. 

One logical approach is to design the wings so that when they are tom from the fuselage or are 
broken into several sections during the accident, the separations will occur in safe areas, rather 
than through fuel tanks. 

This would require strategically located small dry bays between wing tanks and between the 
tanks and the fuselage. Also, self-sealing points of separation would have to be designed into the 
fuel plumbing. Landing gear loads could be carried by the aircraft structure in such a manner 
that crash loads would cause predictable failures in fuel-free areas, rather than in the fuel system. 
If the tanks are not breached, the effectiveness of ullage space inerting would be increased and 
might become cost-effective. 

Another area of consideration is the material properties of the wing tank structures. Some 
materials deform and tear in a ductile manner and some shatter in a brittle manner. The latter 
results in much greater destmction of the tank with a faster release of fuel during the impact 
sequence. To the knowledge of the authors of this report, there are no design requirements for 
wing tank structures regarding these failure modes. 

5.3.2 Center Tank Disruption . 

The center tank walls on large low-wing transport aircraft are usually a part of the strongest 
stmcture of the airframe, carrying the loads between the wings and landing gear and the fuselage. 
In gear up or gear separation accidents, these tanks can contact the ground and can dig into soft 
terrain and develop high G loading. They can also be impacted by parts of the forward fuselage 
and nose gear during forward movement during the crash sequence. Protection of these tanks 
from rupture or penetration is a significant task, again, in accidents which may not deliver high 
forces to occupants other than those on seats directly above the tank. In addition, the location of 
electrical components and equipment bays is often adjacent to center tanks, providing ready 
ignition sources. 


5-16 



It may be possible to design crash-resistant bladders for some of these configurations. However, 
this would require changes in the structural design of current aircraft and would most likely have 
to be part of the original design, not a retrofit to existing designs. Consideration should be given 
to designs in which the fuselage will not dig into soft terrain, e.g., having lower bulkheads canted 
aft and/or a structural keel running from the aircraft nose aft toward the wing forward spar. 

Separation of the fuselage often occurs just ahead and behind the center wing box section. When 
fuel is released from the center tank, occupants over the wing can have fire both ahead and 
behind them. Prevention of center tank fuel loss can provide a significant improvement in crash 
fire survivability. 

5.3.3 Fuselage Tanks . 

The October 1999 drop test of an auxiliary tank in the lower fuselage of a B-737 section resulted 
in a leak due to penetration of the tank by fuselage longerons. This does not violate any 
requirement in the current regulations. However, this does not meet the requirement of the 
proposed revision to 14 CFR Part 25.963 (NPRM 89-11 A, see section 8.44) which requires that 
“Fuel tanks within the fuselage contour ... be located in a protected position so that exposure to 
penetration or damage due to fuselage deformation ... is unlikely.” 

It should be clear that such tanks can be located in various places in large transports, such as 
forward of the wing, immediately aft of the wing, and far aft in the cargo compartment. Each 
location could see different crash environments in a given crash, just as occupants in different 
parts of the aircraft can see different crash forces and effects. In addition, testing of these tanks 
has been confined to a single direction of impact load, rather than the combined effects of real 
crash loads. A tank in the forward cargo area could see both aft and upward impact loads, as 
well as possible impact by nose gear components. Again, the loads on a tank in the lower cargo 
area are likely to be much different than those experienced by occupants above the floor, and to 
use the loading criteria for occupants for any such installation is unrealistic. 

Development of appropriate impact conditions for specific locations of main and auxiliary tanks, 
including those in the horizontal and vertical tail, should be a task undertaken by fuel system 
designers. In addition, consideration of the effect of the tank on occupants seated above the tank 
should be part of the design task since drop tests have shown that the forces on seats above the 
tank were higher than on seats not located above tanks. 
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6. STATUS OF CURRENT TRANSPORT CRFS TECHNOLOGY AND IMPLEMENTATION. 


6.1 COMPARISON OF MILITARY AND CIVIL CRASH ENVIRONMENTS . 

Accidents of large transport aircraft, both civil and military, have been studied for over 50 years. 
Some of those studies were specifically directed toward crashworthiness, and some of the 
crashworthiness studies were specifically focused on the postcrash fire issue. Throughout this 
period, the military studies have been both comprehensive and extensive. Conversely, the civil 
studies have been more sporadic; however, they have been able to benefit greatly from the 
knowledge gained from the military effort. 

A review of past military and civil studies indicates that there are significant differences between 
the researchers’ definitions of the upper level serious, but survivable accident. The helicopter 
industry attempts to define its upper level survivable accident as a function of velocity changes 
over a given time frame and the maintenance of safe space around the occupant throughout the 
crash sequence. When presented as a function of vertical velocity only, it has been suggested 
that the upper level for the civil helicopter is around 26 ft/sec. The military helicopter is 
engineered for greater survivability and can protect its occupants in accidents with vertical 
impact velocities of up to 42 ft/sec or more and resultant velocities of 65 ft/sec. or more, 
depending on whose study is being reviewed. Efforts to correlate similar civil and military data 
for large transport aircraft is currently not possible because of the lack of necessary accident 
data. 

Military and civil researchers tend to think that their respective aircraft as being different from 
those of the other group. While this is true to some extent, many military aircraft have civil 
counterparts. It is generally believed by the civil sector that, because their aircraft fly different 
missions, they crash differently. It is the opinion of the authors of this report that the crash 
differences are not as great as generally believed by the civil sector. Whichever opinion is 
correct, the real issue is that there is no clear understanding of the actual civil and military large 
transport aircraft crash scenarios, because insufficient data has been collected to support 
comprehensive conclusions. 

The overall intent of crashworthiness integration into a given aircraft design is to save lives. 
Charts, such as those shown in figures 6-1 and 6-2, can quickly put the crash survivability issue 
into perspective. Enlarging the survivability segment is an obvious goal. Although the actual 
segment sizes portrayed on the charts are for illustrative purposes only, charts such as these need 
to be developed from actual crash data to focus research efforts toward saving more lives. 
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LARGE TRANSPORT AIRCRAFT CRASHES 

SURVIVABILITY PERCENTAGE 



FIGURE 6-1. PERCENTAGE OF ALL LARGE TRANSPORT AIRCRAFT CRASHES THAT 
ARE SURVIVABLE, PARTIALLY SURVIVABLE, AND NONSURVIVABLE 
(Segment sizes are for illustrative purposes only and are not based on actual data.) 


SEVERITY SCALE . 



SEVERITY COULD BE 

BASED ON - 

• Velocities at Impact 

• Velocity Changes at 
Impact 

• Impact Attitudes 

• Impact Angles 

• Available Livable 
Space 

• Fatality Count 

• Other Units and/or 
combination of the 
above 


FIGURE 6-2. SEVERITY SCALE OF ALL LARGE TRANSPORT AIRCRAFT CRASHES 
(Segment sizes are for illustrative purposes only and are not based on actual data.) 
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Both the military and the civil sectors have endeavored to design sufficient crash resistance into 
their respective aircraft to enable them to state that their aircraft are capable of protecting 
occupants from the anticipated crash loads defined in applicable FARs and military 
requirements. While this statement conveys that a level of protection exists, it does not give any 
indication of the percentage of accidents that is protected. The 95 th percentile upper limit 
survivable accident is one of the units of measurement used by helicopter designers when 
discussing the relative crashworthiness level of their helicopters. No such unit of measurement 
has been developed for large transport aircraft. The 95 th percentile upper limit survivable 
accident, simply stated, means that 95% of the survivable accidents are of this severity or less. It 
does not indicate what percentage of all accidents is survivable. 

Survivable accidents as a percentage of all accidents depends on the crash resistance of the 
airframe and the level of protection afforded by the seats and restraint systems, as well as the fuel 
system. Before aircraft designers can develop significant crash-resistant improvements, they 
must think of survivable accidents* in terms of human tolerance levels, and not in terms of the 
number of accidents in which people are killed. The two most commonly used methods of 
determining survivability are counting the dead and determining the G/time histories known to 
be survivable coupled with the maintenance of livable space throughout the entire crash 
sequence. It has been theorized by researchers attempting to define the “survivable accident” 
that a positive correlation exists between these two methods. This correlation, however good it 
may be, does little to help the aircraft designer because defining survivability by using a body 
count rarely yields sufficient engineering data to permit the design of retrofit kits for the existing 
fleet, let alone the design of new aircraft for which there is no accident data available. 

Some researchers who have studied accident severity (relative to human survival in elevated G 
versus time environments) have concluded that velocity in the vertical direction, as opposed to 
the longitudinal or lateral direction, is the most life threatening, because vertical velocity is 
reduced to zero so quickly during most ground impacts that high G forces are transmitted to the 
occupants. The authors of this report agree that vertical forces are a major threat but not to the 
exclusion of longitudinal forces. This is especially true when one considers that the longitudinal 
velocity, which is usually the higher of the two, combines with the vertical velocity to produce 
the actual crash forces that are transmitted to the occupants and to the fuel system during the 
crash impact and slide out. 

Longitudinal velocity usually transmits lower G forces to the aircraft occupants because the 
aircraft takes longer to stop in the longitudinal direction. While this lower G environment is 
favorable from the standpoint of the occupant, it creates two additional major threats to the fuel 
system. 

First, when portions of the aircraft start to slow down in the longitudinal direction, they are often 
brought to an abrupt halt by contacting heavy or unyielding objects such as automobiles, 
telephone poles, stumps, and rocks. The localized G forces generated by these abrupt stops are 


* 

A survivable helicopter accident, as defined by the U.S. Army, the NTSB, and by crash survivability researchers in 
the field, is an accident in which the forces transmitted to the occupant through the seat and restraint system do not 
exceed the limits of human tolerance and in which a safe space around the occupant is maintained throughout the 
entire crash sequence. 
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usually far greater than those transmitted to the occupants in both the longitudinal and vertical 
direction. If part of the fuel system is located in these areas (e.g., the front or bottom of the 
aircraft), it will experience these higher, localized forces. Unless the entire fuel system is located 
away from these anticipated impact areas, it must be designed to withstand much higher G levels 
than the occupants. Thus, overall aircraft velocity change data cannot be used directly as criteria 
for CRFS design. Additionally, any attempt to establish different design and/or test criteria for 
civil versus military CRFS should be based on detailed accident studies and extensive testing, 
not just on differences in overall aircraft velocity changes during the crash sequence. 

Second, extensive structural displacement occurs during the wreckage slide out, and this 
displacement literally pulls the fuel system apart. The CRFS designer must factor in this 
displacement by allowing the fuel system to move separately from the structure without 
significant leakage. Where the displacement is not expected to be large, frangible attachments 
and flexible, extra-length fuel lines might suffice. In areas of extensive structural displacement, 
the CRFS designer must either (1) move the fuel system out of the area or (2) design in “safe 
failure points” by using self-sealing breakaway valves, etc. In both cases, the fuel system 
components must also be able to withstand all the crash forces likely to occur in their locations. 

6.2 CRASH-RESISTANT FUEL SYSTEM DESIGN ISSUES . 

The principal objective of implementing CRFSs in aircraft is to protect the occupants from 
injuries caused by postcrash fire. Properly designed and configured CRFSs can (in order of 
preference) (1) prevent the onset of a postcrash fire by containing all fuel and other flammable 
liquids; (2) delay the onset or minimize the severity of postcrash fire by minimizing spillage or 
directing it away from potential ignition sources; or (3) isolate a postcrash fire from impinging 
on occupied areas of the airframe long enough for occupants to make their way to safety. 

The predominant criterion for aircraft designers is to determine the level of severity of a crash 
that must be accommodated by the CRFS. The traditional large transport aircraft approach has 
attempted to provide a fuel system that will survive the crash loads specified in the FARs without 
a dangerous spillage of fuel. A CRFS must safely survive crash environments in which 
extensive structural displacement occurs, such as often occurs during accidents with high 
longitudinal speed or impacts. As straightforward as the objective appears, it is difficult to 
achieve in practice unless the designer has sufficient knowledge and data available to define the 
approximate crash parameters of “survivable” accidents in the type of aircraft in question. In 
addition, advances in other areas of crash survivability, e.g., seats and restraints that attenuate 
crash forces transmitted to occupants, have allowed occupants to survive in accidents that are 
severe enough to totally destroy the aircraft. It is, therefore, not unreasonable to require the 
CRFS to safely contain fuel throughout the entire severe crash sequence. 

CRFS designers for helicopters and light airplanes routinely use occupant survivability data as 
their criteria for fuel system design. This data, in the form of loads generated by the velocity 
changes experienced during 95 th percentile survivable crashes, is based on innumerable, in-depth 
accident investigations and extensive full-scale crash tests. The vertical velocity changes 
experienced by these small aircraft as determined from accident data, are shown in figure 6-3. 
This figure shows that the 95 th percentile survivable crash has a vertical velocity change of 42 
ft/sec in the occupiable area during the major impact. 
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FIGURE 6-3. VERTICAL VELOCITY CHANGES FOR SURVIVABLE ACCIDENTS IN 
SMALL AIRCRAFT (Rotary and light fixed wing) 

Unfortunately, these criteria cannot be transferred directly to transport airplanes because of their 
larger size. Indeed, even defining “a survivable accident” for transport airplanes in the context 
of velocity change during impact is questionable. The definition of a survivable impact 
ultimately relates back to human tolerance levels to applied forces, accelerations, and their 
durations. If the aircraft and the occupant both experience similar velocity changes during a 
crash, then crash survivability can be defined by the aircraft response in its occupiable area, at or 
near the aircraft center of gravity. This is the case with small aircraft, such as helicopters and 
light airplanes. This principle is illustrated for small aircraft in figure 6-4. The center of gravity 
(eg) of the aircraft shown in figure 6-4 is denoted by the small checkerboard circle. The large 
cross-hatched areas fore and aft of the eg encompasses the occupant area. As can be seen in the 
figure, the occupant area in the small aircraft is not large enough or far enough away from the eg 
to experience significant differences in velocity changes during an accident. Thus, the velocity 
changes and accelerations seen at the aircraft eg are reasonably valid throughout the occupiable 
area. 

On the other hand, the passenger compartment in a large transport airplane is much larger and a 
significant number of occupants are located a considerable distance away from the airplane’s eg. 
They are outside the area of the airplane which can be expected to have similar velocity changes 
to those at the eg during impact. The cross-hatched area A of figure 6-4 indicates an area that 
will likely experience similar velocity changes as the eg, whereas cross-hatched area B will 
likely have significantly different velocity changes during the accident. KRASH analysis has 
shown that sink velocities over 22 ft/sec would likely break the fuselage shell and that 22 to 25 
ft/sec might be a reasonable survivable limit for the overall passenger compartment of large 
transport aircraft (see section 2.3.4). This value is considerably lower than the 42 ft/sec vertical 
velocity change for the 95 th percentile survivable accident in the smaller aircraft. 
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FIGURE 6-4. OCCUPIABLE AREA SIZE AND LOCATION RELATIVE TO THE 
CENTER OF GRAVITY IN LARGE AND SMALL AIRCRAFT 

Should the designer then use 25 ft/sec vertical velocity change as one of the criteria for the 95 th 
percentile survivable accident for transport airplanes? No! Using this value presupposes that the 
velocity changes and accelerations are similar throughout the entire passenger compartment 
enclosed by area B in figure 6-4. However, this supposition is not valid. It was previously 
shown that the area over the center wing is stronger than the fore and aft sections of the fuselage. 
Drop tests have shown that vertical velocities up to 30 ft/sec are readily survivable for occupants 
near the center section (see section 3.2). In addition, passengers seated in the fore and aft 
sections of the aircraft may experience widely diverse impact conditions depending on the 
dynamics of the specific accident. 

At the present time, there is no single value which will adequately define the vertical velocity 
change of the 95 th percentile survivable accident for large transport airplanes. If the values of 
20-25 ft/sec are used by the CRFS designer, there is a grave danger that the CRFS will fail at 
levels well below the survivable range of many of the airplane occupants and expose the 
surviving occupants to a crash fire. There is an urgent need to define the velocity changes which 
are survivable throughout the aircraft during typical transport airplane crashes. The time and 
effort must be spent to define how these impact conditions should be measured and to gather the 
necessary data. Only then can the CRFS designer be confident that the fuel system will 
accomplish its intended purpose of protecting the occupants from fire up to the survivable limits 
of transport airplane accidents. 

In the April 2000 FAA study titled “Benefit Analysis for Aircraft 16-g Dynamic Seats” [60], 
R.G.W. Cherry and Associates, Ltd. defines the methodology and rationale for a new 
mathematical model called a “Survivability Chain:” 
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Accident Scenarios 


The severity of hazard in an accident can vary markedly throughout the aircraft. 
Experience has shown that considering occupant injuries on a whole aircraft basis 
can be misleading when assessing the effects of survivability factors. It is therefore 
necessary to divide the aircraft into scenarios. 

A scenario is defined as " That volume of the aircraft in which the occupants are 
subjected to a similar level of threat. ” ( emphasis in the original). 

A similar level of threat need not necessarily result in the same level of injury to 
occupants. The extent of injury sustained can vary with numerous factors including 
age, sex, adoption of the brace position, etc. Furthermore, the threat to occupants 
can vary over relatively small distances. For example, a passenger may receive fatal 
injuries because of being impacted by flying debris, and a person in an adjacent seat 
may survive uninjured. Dividing accidents into scenarios provides a more 
meaningful basis on which to analyze accidents than considering the whole aircraft 
due to the marked variation in survival potential with occupant location. 


Survivability Chain 

A mathematical model, known as a Survivability Chain (see figure 6-5) . . . enables 
assessment to be made of the overall effect on survivability factors, taking into 
account injuries that may be sustained by occupants. 


. . . Where sufficient data are available, each accident is divided into scenarios and a 
Survivability Chain constructed. 



FIGURE 6-5. EXAMPLE OF SURVIVABILITY CHAIN FOR AN ACCIDENT SCENARIO 

(From reference 60) 
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The Survivability Chain enables analysis of the effects of specific improvements to survivability 
factors on each scenario (see above definition) which might be present within the passenger 
compartment. For each scenario, a numerical assessment can be made of the effects of changes 
on numbers of fatalities and injuries. The Cherry report continues: 

Whilst it is recognized that the models are not perfect representations of an accident 
nor are the statistical assessments totally accurate, they will provide a better 
assessment of the likely effects of improvements to survivability factors that would 
otherwise be derived from a simple estimate of the resultant change in number of 
survivors. 

Applying Survivability Chain-or similar-analysis methodology to the effects of postcrash fires 
can improve the robustness of data on which decisions are made for pursuing new initiatives 
toward minimizing occupant risk. For example, current ad hoc investigation techniques 
minimize the likelihood of recognizing patterns of evidence which might identify inherent design 
factors which increase risk. Standardized investigation methodologies are required to enable 
valid statistical identification and follow-up of existing survivability factors and their 
improvements. 

The CRFS must be designed within the constraints of aircraft performance requirements and 
within the boundaries of numerous rules and regulations. Standards, regulations, and 
specifications have been established for CRFS design for both civil and military helicopters. 
Many of these standards are directly applicable to large transport aircraft, the subject of this 
study, and are discussed throughout this report. 

The acceptable crash fire environment must also be defined. While complete elimination of 
postcrash fire is the surest way to prevent fire injuries, it is sometimes possible to prevent 
injuries even if a postcrash fire occurs by minimizing the size of the fire and isolating it from the 
occupants long enough for them to escape. The designer can estimate the reduction of the 
postcrash fire hazard of various CRFS modifications by using appropriate hazard analyses and 
risk assessment procedures discussed in section 7 of this report. 

Within the framework of all of these considerations, highly successful crash-resistant fuel 
systems have been designed and utilized. This section of the report summarizes the current 
status of knowledge in CRFS technology and the level of implementation of CRFS in large 
transport aircraft. 

6.3 GENERAL SYSTEM DESIGN CRITERIA . 

Crashworthy fuel system design must fit within the framework of established fuel system design 
parameters. These overall criteria may be summarized in the following outline: 

• Aircraft Performance 

Operating Conditions 
Crash Conditions 

Occupant Survivability Level Desired/Possible 
Structural Reaction to Crash 
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• Overall Fuel System Design 

Performance 

Simplicity 

Reliability 

Location 

• Individual Component Design 

Location 

Performance (operational and crash resistant ) 

Materials 
• Reliability 
Maintenance 

• Design Aids 

Standards 
Checklists 
Hazard Analyses 
Handbooks and Guides 

6.3.1 Aircraft Performance . 

The primary factor to be considered in fuel system design is the performance required of the 
aircraft. The system must be designed to allow the aircraft to accomplish its design goals and to 
operate successfully during all required operational modes of the aircraft. This principle must be 
followed in successful CRFS design as well. However, the CRFS also must be designed to 
perform its intended function of preventing or minimizing dangerous spillage and resulting 
postcrash fire. To that end, the criteria listed in italics in 6.3 pertain specifically to crash- 
resistant design and generally have not been included previously in standard fuel system design 
criteria. 

The common parameters of crash conditions for the type of aircraft in question must be defined 
and quantified in order to determine the level of performance expected for the CRFS. For 
example, large aircraft tend to crash with higher vertical and longitudinal velocities than do small 
aircraft. Expected crash velocities must be obtained from accident data gathered for the aircraft 
in question or extrapolated from crash data on similar specific aircraft models. The occupant 
survivability level in these crashes must be ascertained. The survivability criteria could be 
defined in terms of crash loads transmitted to properly restrained occupants and to the 
preservation of occupiable space around the occupant, irrespective of whether the occupants did 
or did not survive [85]. Whatever criteria are selected, they must be correlated with the level of 
occupant survivability desired. 

Before the CRFS can be designed, the aircraft structural response to these anticipated crash 
conditions must be determined. Crash data can be helpful in determining structural response of 
similar designs. Design analyses and computer studies should also be utilized to determine 
anticipated failure modes and locations of structural deformation during crashes. This 
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information is essential in determining CRFS component locations and performance 
requirements. 

6.3.2 Overall Fuel System Design . 

The fuel system, as an integrated system, must be designed to function under all foreseeable 
environmental and operational conditions that might be encountered during the life cycle of the 
aircraft. The CRTS must perform its function within the desired survivable crash envelope as a 
whole system and not simply a collection of individual components. Whatever conditions are 
imposed upon a component and its reaction to those conditions could well compromise the 
integrity of an adjacent component (e.g., if a fuel line is trapped in a deforming and separating 
structure, the forces transmitted through the line might pull the hose out of the hose-end fitting, 
break the hose end fitting or break the component that is attached to the hose-end fitting, 
allowing fuel leakage even if the integrity of the hose itself is maintained). 

The location of the fuel system and its components is constrained by the configuration and 
performance requirements of the aircraft. However, the CRFS location must be incorporated 
into the aircraft very early in the design process so that the fuel system and its components are 
protected from crash damage to the maximum extent possible. 

Accurate crash data does not currently exist to either define the level of airframe structural 
damage or the level of occupant survivability as functions of impact velocities and resultant G 
forces. As a consequence, today’s CRFS designer is unable to accurately determine the crash 
severity level in which the CRFS must safely contain fuel. 

Two concurrent paths could be followed to eliminate the dilemma that the CRFS designer faces. 
First, the CRFS designer must be given access to crash severity data recorded by skilled crash 
investigators from detailed crash investigations that are conducted both in the field and through 
review and analysis of past accident investigation reports. 

Second, pending the accumulation of accurate crash data, the CRFS designer should design the 
CRFS to withstand the structural loads and structural displacements that occur during typical 
takeoff and landing accidents. These accidents are the most likely to have survivors. Overall 
observations of the effects of crash loads and structural displacements in takeoff and landing 
accidents clearly indicate the following typical fire producing scenarios: 

a. Engines are displaced. 

b. Fuel tanks are ruptured. 

c. Fuselages are crushed and often broken and/or separated into various segments. 

d. Wing leading edges and wing root areas, especially those in and near the landing gears, 
are severely damaged. 
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e. Fuel and oil lines are cut, tom, pulled from their end fittings or otherwise broken in such 
a manner that dangerous spillage occurs, and are often made more hazardous because the 
fluids are heated and/or pressurized. 

f. Fuel and oil system components are damaged causing dangerous spillage. 

The fire threat associated with these readily foreseeable hazardous situations can be greatly 
reduced by using fuel system design aids such as the Fuel System Hazard Level Reduction 
process discussed in Section 7.2, the Fuel System Design Checklist in appendix C and by 
implementing the following basic CRFS design concepts: 

a. Incorporate state-of-the-art crashworthy bladders in as many fuel tanks as is reasonably 
practical. 

b. Avoid locating fuel and oil lines in areas of anticipated impact or extensive structural 
displacement. 

c. If unable to safely locate fuel and oil lines, incorporate self-sealing breakaway valves in 
the lines where impact and extensive displacement is anticipated. 

d. Incorporate methods to stop the pressurization of crashed aircraft fuel and oil lines. 

e. Incorporate penetration-resistant structures in areas vulnerable to damage by blown tires, 
shattered wheels, landing gear struts and trunions, and by wing slats, flaps, gear doors 
and other structures that may be driven into areas of the aircraft where fuel is located, 
either in tanks or in the plumbing system. 

The design philosophy for the CRFS must, by necessity, follow two paths. One defines the 
probable or anticipated fuel spillage methods that will occur at the crash severity level selected, 
while the other evaluates the relative crash-resistant features of the specific items making up the 
CRFS. As an example, if a fuel filter assembly does not incorporate a high level of 
crashworthiness in its design, it could still function safely in a crash if it were mounted in an area 
that was deemed to remain “safe” during the upper limit survivable accident. However, if the 
component must be located in an area where extensive crash damage is likely, the component 
must incorporate crash safety features inherent in its design. 

Some crashworthy design features incorporated in current transport airplanes involve the use of 
fuel shut off valves that can be closed by the flight crew two completely separate ways, either 
electrically or by mechanical linkages. The concept being that if one method is rendered 
inoperative, the other can still be used. 

Another crashworthy scheme employed in some current airplanes is to route the fuel lines in 
such a manner that as the engine or other components are separated from the airframe, the 
pulling force applied to the fuel line causes it to break, predictably, down stream of manually 
actuated shutoff valves, rather than remain intact, literally pulling the fuel lines out of the 
airframe - shutoff valves included. 
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The design of the fuel system should be kept as simple as possible commensurate with its design 
objectives. Simplicity generally leads to increased reliability and ease of maintenance. There is 
an added benefit for the CRFS — simplicity generally reduces the number of possible unsafe 
failure points during a crash. 

6.3.3 Individual Component Design . 

Fuel system components are routinely designed to be structurally sound during all normal flight 
and service loads. These components, with no modification, could be used to create a CRFS that 
would function as desired in the selected upper level survivable accident. To do so, however, 
could require that the airframe behave in a specific manner regardless of the crash environment. 
Further, it is probable that structural enhancement and reinforcement would be required in areas 
where the noncrashworthy components were located. While such a CRFS could be built, the 
weight and other design considerations, i.e., component location and fuel line routing, render the 
approach less than desirable. 

A great deal of information has been written about the design of CRFS components. The 
Aircraft Crash Survival Design Guide is the most comprehensive and most current source of this 
material [86] and should be the designers’ principal reference for design guidance. There are 
several key components of the CRFS, however, that are worthy of additional discussion. They 
are the fuel tanks and its fittings, the self-sealing breakaway valve, the fuel lines and their 
fittings, vent valves, drain valves, and spillage control valves. If the reader wishes to obtain 
more detailed information regarding these components, refer to the Aircraft Crash Survival 
Guide, which has been a helpful aid for the following discussion. 

6.3.4 Tanks and Fittings . 

Transport aircraft flying today carry their fuel in different types of tanks. Some, referred to as 
integral tanks, are merely open areas within the wings, sealed with a coating to prevent seepage. 
Others utilize bladders of varying degrees of crashworthiness. Still others use tanks made of 
metal or various composite materials. 

The ideal fuel system is one that completely contains its contents both during and after an 
accident of such severity as to be at or slightly above the upper limit of human survivability. The 
fuel must be contained no matter how the basic structure fails and regardless of the magnitude of 
the displacements of the fuel system components relative to the aircraft structure. Similarly, all 
possible crushing loads, penetrative loads, and inertia loads must be carried without leakage. 
Integral tanks, in spite of the various efforts to improve their containment capabilities, are not 
presently able to safely contain their contents in most accidents where human life is threatened. 
The most reliable “fuel containment concept” today involves, as a prime element, the use of 
flexible, high strength, cut- and tear-resistant fuel bladders built with construction materials and 
fittings that improve the ability of a fuel system to contain fuel under survivable impact 
conditions. Although this ideal fuel system is, at times, difficult to achieve, the military 
helicopter accident history over the past 25 years clearly demonstrates that it can be done. 

While the researchers and developers of the 1950s would undoubtedly embrace the definition of 
the ideal fuel system, and while they would applaud today’s application of the fuel containment 
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concept, their own efforts were generally unsuccessful. Their early work [20 and 21] ultimately 
resulted in the issuance of MIL-T-27422 and MIL-T-27422A, but exhaustive testing of the 
requirements contained in those specifications was not undertaken until the AvSER research of 
the 1960s. 

The testing of the crash-resistant fuel tanks developed in accordance with MIL-T-27422 A 
revealed at least three major shortcomings. The first was the underestimation of the vertical, 
longitudinal, and lateral loads being applied to the fuel system in severe, but survivable 
accidents. Since many aircraft fuel tanks are located low in the structure, in the wings and/or 
very near the airframe outer surfaces, they are subject to severe loads. Additional loads can be 
added to the tanks by the close proximity of passengers, cargo, landing gear, and in some cases, 
the engine. 

The second shortcoming was the failure to consider the fuel tank fitting pull-out problem and the 
puncture and tear-resistance properties of the fuel tank that are needed to prevent penetration by 
the jagged metal and broken spear-shaped components of the failing structure. When puncture 
coincides with the high-pressure loading of the tank during the crash sequence, the tearing of the 
fuel tank wall progresses rapidly away from the puncture wound. Although the early CAA work 
recognized the potential danger from puncture and tear, no attempt was made to establish a 
material requirement in MIL-T-27422A for this phenomenon, for the problem related to tank 
wall strength relative to the metal fitting sizes or shapes, or for the fitting locations in the fuel 
bladder. 

The third shortcoming was the failure to recognize that fuel system components, including the 
tanks, are often subjected to, and impacted by, aircraft structure that is being tom apart and 
displaced a considerable distance. Requirements for tank design that would allow for safe 
separation from the displacing, and sometimes very sharp, structures were not even considered. 

With the demonstration of improved materials in the crash testing conducted during the 1960s 
[87], and with the development of new tests for measuring fuel bladder crash-resistant properties, 
MIL-T-27422A was completely revised. In addition to the standard qualification tests of 
noncrashworthy fuel tanks, as specified in MIL-T-6396 (bladder tanks) and MIL-T-4478 (self- 
sealing tanks), a draft of MIL-T-27422B [88] was issued containing a battery of new 
requirements related to crash-resistant fuel bladder testing. These new requirements included a 
series of tear-resistance tests, followed by tank drop tests. Both test series are worthy of further 
discussion in this report. 

6.3.4. 1 Tear Tests . 

During the extensive research test activities of the 1960s and 1970s, as well as during the 
concurrent detailed crashworthiness fuel system investigations of aircraft crashes, it became 
readily apparent that the level of bladder material tear resistance was a key factor in preventing 
dangerous fuel spillage. In many crashes, metal fittings integral to the bladders would remain 
attached to the displacing airframe structure, tearing out of the bladder walls and thereby 
releasing large quantities of fuel. In addition, bladder punctures that frequently occurred would 
continue to tear the bladder, especially during the fluid pressure buildup phase of the crash 
impact. These tears also allowed large quantities of fuel to escape. The need to safely retain the 
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metal fittings in the bladder and the need to find a satisfactory solution to the puncture-tear 
propagation problem were key concerns in establishing the tear-resistance requirement. After 
almost 10 years of testing, 400 ft- lbs of energy was determined by the authors of MIL-T-27422B 
to be the appropriate constant-rate tear requirement for small-to-medium-size aircraft* with fuel 
tank quantities of up to 1,000 gallons. The research team concluded that additional research in 
all aspects of fuel tank crash resistance should be conducted before tanks with capacities 
exceeding 1 ,000 gallons were used or before such tanks were installed in thicker-skinned, larger- 
size aircraft. 

6.3.4.2 Fuel Tank Crash Impact Test . 

A 65-foot free-fall drop test was established by the researchers and authors of MIL-T-27422B 
after almost 10 years of test activity, including hundreds of actual tests. The 65-foot height was 
identified as the minimum drop test height that would verify the load-carrying capability of an 
unsupported bladder with all of the bladder metal fittings installed, and that would verify bladder 
seam continuity and strength, particularly in the bladder sidewalls. Bladders must also possess a 
high degree of cut and tear resistance to safely survive the upper level survivable accident. 
These are key issues that are brought into play when bladders are required to bridge gaps 
appearing in the airframe due to structural displacement associated with an upper limit 
survivable accident and/or when bladders are also being compressed by strong, heavy, and often 
sharp structures. Bladders constructed of highly extendable materials, but low in cut and tear 
resistance, have been able to easily pass 65-foot drop tests; however, if the bladders contact a 
sharp edge or a penetrative object while being distended at impact, massive fuel spills will occur. 
The failure is analogous to sticking a pin in an inflated balloon. 

Because the 65 -foot drop test height was determined to be the minimum height required to verify 
necessary bladder strength, no margin of safety was built into the height of the drop test. Instead, 
a margin of safety was obtained by specifying that the tank be filled to 100% of capacity with 
water. Because the weight of water is approximately 20%-25% greater than the weight of 
aviation fuels, a margin of safety is achieved. In many applications, this margin of safety for a 
critical item might appear to be low, but given the track record that the CRFS has established 
during the last 25 years, the margin of safety appears to have been appropriate. 

It is interesting to note that shortly after the 65-foot crash impact test height was established as a 
result of the extensive military research program, units of measurement defining a reasonable 
upper level survivable accident for the small-to- medium-size aircraft were emerging in the form 
of velocity changes occurring during the crash in three directions — vertical, longitudinal, and 
lateral. The resultant speed, the speed and direction actually traveled by the occupants when all 
three speeds were combined, often exceeded 75 ft/sec. However, further study of the data 
indicated that the frequency of occurrence of the higher velocity accidents was quite remote. 
Consequently, a resultant speed for the upper level survivable military accident has been focused 
in the 65 ft/sec range. 

If the same exhaustive research that gave rise to the original 65-foot drop test height were 
undertaken today, the drop test height might be increased. Today’s military helicopters 


* An arbitrary selection defining airplanes that could seat up to 50 occupants. 
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incorporate many crashworthiness features, including full CRFSs, and are clearly safer than were 
their predecessors. Seat technology has been greatly improved, airbag programs are being 
implemented, in some cases survivable space is being enhanced, and other safety features are 
continually being added. As a result, occupants are surviving more severe crashes today than 
ever before. In fact, many helicopters crash onto soft ground containing rocks, stumps, and trees 
at higher longitudinal velocities than the 100 ft/sec (68 mph) speed referenced in MIL-STD- 
1290A and are still being considered survivable. An indication that the current fuel systems are 
not overdesigned is that postcrash fires are still occurring in crashes that are only slightly above 
the upper limit survivable accident. 

6.3.5 Self-Sealing Breakaway Valves . 

Fuel and oil is moved from one location to another within the aircraft airframe through flexible 
and/or rigid hoses or tubes. During accidents where structural displacement is great enough, 
these fluid-carrying lines are often pulled beyond their stretching capability, causing them to 
separate and spill readily ignitable fluid. Spillages due to this type of plumbing failure can be 
greatly reduced by the use of self-sealing breakaway valves (SSBV). ' 

Self-sealing breakaway valves are valves designed to separate into two or more sections and seal 
the open ends of designated fluid-carrying passages. The openings may be in fuel/oil lines, 
tanks, pumps, fittings, etc. The valves fall into two general categories: the “frangible” type, 
which incorporates a portion that breaks apart, allowing valve closure and separation (figures 6-6 
and 6-7), and the quick-disconnect type, which is installed so that it will be disconnected during 
the crash sequence (figure 6-8). Some valves in use today have both these features incorporated 
into their design. Each fuel system design will dictate which of the two types of valves can or 
should be used. In either case, the valves must be installed in a manner that precludes 
inadvertent operation. 

Self-sealing breakaway valves have been successfully used in the DC-9 auxiliary fuel system 
since the early 1970s. While figure 6-7 provides a simple overview of the subject valve, the 
reader is referred to appendix A of this report for more detailed information. 



FIGURE 6-6. FRANGIBLE TYPE SELF-SEALING BREAKAWAY VALVE 
INSTALLED AS A TANK OUTLET (These type valves are closed and 
separated by displacement of one of the valve halves.) 
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SELF-SEALING BREAKAWAY 
VALVLE V 


SHEAR PINS 




PULLING THE HOSE SHEARS THE PINS, RELEASING THE VALVE HALVES 
TO SEPARATE SAFELY AND SEAL BOTH ENDS. 


FIGURE 6-7. FRANGIBLE TYPE SELF-SEALING BREAKAWAY VALVE, AS USED 
IN THE FUEL LINE OF SOME CURRENT LARGE TRANSPORT AIRCRAFT 

AUXILIARY FUEL SYSTEMS 



FIGURE 6-8. QUICK DISCONNECT VALVE INSTALLED TO OPERATE AS A 
SELF-SEALING BREAKAWAY VALVE 

The forces that are usually applied to self-sealing breakaway valves to cause separation and 
closure are transmitted by a pulling movement of the flexible fluid-carrying hose. As the hose 
stretches, a force is transmitted to the valve. If the force is great enough, a component finally 
fails. Hopefully, it is the valve. Unfortunately however, sometimes it is the other end of the 
hose or a hose-end fitting. Guidelines to ensure that the weak link in each load-producing 
system is the frangible section of the self-sealing breakaway valve and not some other link in the 
“chain” are discussed later in this section. 

There are design situations where, for one reason or another, a load path other than the hose must 
be used. Cable lanyards are an acceptable alternative load path technique, and they are used 
today in some aircraft installations (figure 6-9). If lanyards are used to transmit the force to 
cause a valve to fracture and separate, they should be capable of carrying at least twice the 
amount of load it takes to fracture the valve. If they are used to move a release ring, such as on a 
quick-disconnect valve (figure 6-10), they should be at least twice as strong as the force required 
to move the ring. As a general rule, the force required to move a quick-disconnect release ring is 
considerably less than the force required to fracture the frangible section of a self-sealing 
breakaway valve; consequently, a lighter-weight overall system can result. 
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UNION 


ENGINE 
FUEL CONTROL 
CASTING 



\ THIS ACTUAL HOSE AND 
\ ENGINE FUEL CONTROL 
CONFIGURATION WOULD 
FAIL BEFORE IT COULD 
TRANSMIT ENOUGH FORCE 
TO THE SSBV TO CAUSE 
VALVE SEPARATION AND 
CLOSURE, CONSEQUENTLY 
AN ALTERNATE LOAD PATH 
WAS REQUIRED. 
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FIGURE 6-9. CABLE LANYARD USED TO TRANSMIT THE LOAD 
REQUIRED TO CAUSE SEPARATION AND CLOSURE OF A 
TYPICAL SELF-SEALING BREAKAWAY VALVE 



FIGURE 6-10. CABLE LANYARD USED TO TRANSMIT LOAD TO PULL 
RELEASE RING THAT UNCOUPLES QUICK-DISCONNECT VALVE 
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Self-sealing breakaway valves should be located at each fuel-carrying tank outlet and at locations 
within the fuel line network where extensive displacement is foreseeable, such as tanks mounted 
external to the fuselage or in engine compartments. The purpose of these valves is to prevent 
rupture of the tank, hoses, or fitting components by placing a “safety fuse” in the load path. 

A self-sealing breakaway valve (figure 6-11) should be used to connect two fuel tanks in a direct 
side-by-side arrangement if there is a reasonable probability that structure failure or displacement 
will occur in the immediate area of the tanks. 

Tank-to-line interconnect valves should be recessed sufficiently into the tank so that the tank half 
is flush with the tank wall or protrudes only a minimal distance beyond the tank wall after 
separation. This feature reduces the tendency of the valve to snag on adjacent structures during 
the crash sequence. 

The frangible interconnecting member of each of these valves should be sufficiently strong to 
meet all operational and service loads of the aircraft within a reasonable margin but should 
separate at 25 to 50 percent of the minimum failure load for the weakest component in the fluid- 
carrying line. Subsection 29.952(c)(1) of AC 29-2C explains in detail how these loads are 
derived and calculated. 

Each valve application should be analyzed to assure that the probable separation load will be 
exerted in a direction and manner to which the valve is best suited. These loads, whether 
tension, shear, compression, or combinations thereof, are obtained by analyzing the aircraft for 
probable impact force and direction and by determining the consequent structural deformation 
around the valve. Self-sealing breakaway valve designs should not allow dangerous spillage 
during or after valve separation. The valve should permit no external leakage when partially 
separated. 



FIGURE 6-11. SELF-SEALING BREAKAWAY VALVE USED AS A 
TANK-TO-TANK INTERCONNECT 
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For this reason, valves with a very short triggering stroke are superior to those with a long stroke. 

Operational pressures are dependent on specific applications, but the valve designs can take 
advantage of the available line pressure to assist in keeping the self-sealing mechanism closed. 
As in all valve designs, light weight and minimal pressure drop are major design objectives, but 
the resistance of the valve to direct impact or to high compressive loads should not be sacrificed 
for the sake of weight reduction. 

6.3.6 Fuel Lines . 

Damaged fuel lines frequently cause spillage in aircraft accidents. Lines often are cut by 
surrounding structure or worn through by chafing rough surfaces. The use of flexible rubber 
hose armored with a steel-braided harness is strongly suggested in areas of anticipated dragging 
or structural impingement. In systems where breakaway valves are not provided, these 
stretchable hoses should be 20 to 30 percent longer, before stretching, than the minimum 
required hose lengths. This will allow the hose to shift and displace with collapsing structure 
rather than be forced to carry high tensile loads. The practice of routing fuel lines through holes 
in floor beams rather than attaching the lines to the outside of the beams should be avoided 
because it greatly restricts the ability of the lines to shift with displacing structure. 

For this reason, it is equally important that couplings and fittings be used sparingly because of 
their propensity to snag and restrict the natural ability of the hose to shift. 

All fuel lines should be secured with breakaway (frangible) attachment clips in areas where 
structural deformation is anticipated. When fuel lines pass through areas where extensive 
displacement or complete separation is anticipated, self-sealing breakaway valves should be 
used. 

All fittings used in the fuel system should meet specific strength requirements when tested in the 
designated modes. The loads are always applied through the hose with freedom allowed for the 
hose to form the bend radius. Thus, the effective moment arm for the bending tests changes 
primarily with the line size and secondarily as the applied load produces changes in the bend 
radius. This test procedure is much easier to mechanize than one requiring a constant moment 
arm and is typical of what happens in an actual accident. 

In designing a system using line-to-line breakaway valves, one should consider potential hazards 
of cross-axis shear loading on the valve halves. While omnidirectional separation is not an 
absolute requisite for most line-to-line valves, it is highly desirable, and every attempt should be 
made to procure omnidirectional valves if there is any possibility of cross-axis shear loading. 

Fuel lines are often used as the means of applying the loads necessary to cause self-sealing 
breakaway valves to close and separate. While hose and end fitting strengths are discussed in 
this report and in AC 29-2C, it must be remembered that, in order for a valve to be pulled apart at 
a predetermined load value, the structure supporting the opposite end of the hose-to-valve 
connection also must be capable of carrying the load. This includes bulkhead fittings and fittings 
terminating in components such as engine fuel controls, filters, and pumps. Failure to recognize 
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and design around these often overlooked weak links in the fuel plumbing system can negate the 
overall crash-resistant design effort. 

Fuel line routing should be carefully considered during the design stage. Fuel lines should be 
routed along the heavier structural members, since those members are less likely to deform or 
separate in an accident. Avoid placing fuel lines that will normally be carrying fuel, if a crash 
should occur, in areas of anticipated impact damage, such as wing leading edges, the lower 
external skin, and near the landing gear. Evacuated fuel lines can be considered as possible 
exceptions to this rule. Also, it is important that hoses have a space into which they can deform 
when necessary. For example, when hoses pass through large flat-plate areas, such as bulkheads 
or firewalls, the hole allowing line passage should be considerably larger than the outside 
diameter of the line. Hose stabilization as well as liquid-tight, fire-tight seals still can be 
maintained if frangible paneling or baffles are used. 

If design requirements limit the use of the protective measures discussed above, full use should 
be made of self-sealing breakaway couplings located in areas of anticipated failures and 
structural displacements. Crossover connections, drains, and outlet lines present a special 
problem since they are usually located in the lower regions of the tank, where they are vulnerable 
to impact damage. Space and flexibility should be provided at the connections to allow room for 
the lines to shift with collapsing structure. Utmost consideration should be given to using self- 
sealing breakaway fittings at each line-to-tank attachment point. 

6.3.7 Vent Valves . 

Aircraft vent systems can become a source of hazardous fuel spillage when the aircraft remains 
upright and the fuel tank is compressed, the aircraft rolls far enough to one side to allow fuel to 
drain out of the vent lines and/or when the vent lines fail. 

Vent line failure often occurs at the point of exit from the tank. Failure at this point can be 
reduced by using short, high-strength fittings between the tank outlet and the vent line. The vent 
line should be designed to assure that it will discharge fuel passing through it away from the 
aircraft. Consideration should be given to utilizing wire-covered flexible hose routed in such a 
manner that it will not obviously become snagged in a displacing structure and tom from the 
tank. Self-sealing breakaway valves also can be placed at the tank-to-line attachment area. This 
approach becomes mandatory if there is danger of the tank being tom free of the supporting 
structure. 

Vent lines can be routed inside the fuel tank in such a manner that, if rollover occurs, spillage 
cannot continue. This can be accomplished with siphon breaks and U-shaped routing and/or 
traps in the line. 

Many military aircraft, both large and small, incorporate fuel system rollover float/vent valves 
inside the fuel tank. These valves are designed to operate in any attitude and to allow a free flow 
of air while prohibiting the flow of fuel. They are particularly advantageous during rollover 
accidents, and can be used in lieu of flexible lines, breakaway valves, and all other alternate 
considerations. An example of one type of vent valve currently being used in both military and 
civilian helicopters, is illustrated in figure 6-12. 
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If the fuel system is to be pressure refueled, it should be noted that a large bypass system for tank 
overpressurization should be considered. This capability can be built into the vent valve or can 
be incorporated in a separate unit. Large spring-loaded pressure relief valves are in current use 
today. Rollover protection is provided by the spring valve, but tank overpressurization due to 
tank compression causes fuel to be expelled at the vent outlet. In either case, however, care must 
be taken to ensure that spillage resulting from overpressurization due to tank compression during 
a crash is released away from aircraft occupants and the typical ignition sources. 


UP 



FIGURE 6-12. ROLLOVER VENT VALVE PASSES AIR BUT CLOSES IN ANY 
ATTITUDE WHEN FUEL TRIES TO ESCAPE 

6.3.8 Drain Valves . 

Sump drains are a frequent source of fuel spillage because their design dictates that they be 
located at the lowest point in the tank, in close proximity to the most probable impact area. 
Figure 6-13 illustrates one current installation that permits sump drainage without the sump drain 
valve poppet protruding beyond the face of the tank. 
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FIGURE 6-13. SUMP DRAIN VALVE DESIGNED'TO RESIST OPENING OR DAMAGE 

DURING CRASH IMPACT 


6.3.9 Spillage Control Valve . 

During the 1980s two different valves were designed, developed, tested, and FAA certified for 
use on light aircraft [89]. These valves, installed in the main engine fuel line before it enters the 
engine compartment, were designed to stop the flow of fuel to the engine area when the engine is 
not running, as in a crash. Normally, when a fuel or oil line is broken, fluid will drain out. If 
this drainage is in the engine area, ignition by the hot surfaces or other sources is likely. The use 
of breakaway self-sealing valves of either the frangible or quick-disconnect type can stop the 
spillage flow, but they require displacement and resistive forces to be triggered or operated. In 
many small aircraft the structure is simply not strong enough to allow the creation of forces great 
enough to operate breakaway valves. The structure can be locally reinforced, cable lanyards can 
be used, or both can be used if necessary; however, the approach depicted in figure 6-14 uses 
neither. 


FUEL OUTLET 



FIGURE 6-14. SPILLAGE CONTROL VALVE DESIGNED TO STOP FUEL FLOW IF 
ENGINE QUITS OR IF DOWNSTREAM FUEL LINES SEPARATE 


The spillage control valve assembly shown in figure 6-14 consists of a valve body assembly, 
pilot-pressure-operated check valve components, a manual by-pass plunger, a manual by-pass 
control cable assembly, and associated seals and O-rings. When the aircraft engine is operating 
under normal conditions, fuel is drawn from the fuel tanks through fuel lines to the spillage 
control valve. Fuel enters the spillage control valve assembly, passes through the internal valve 
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components and exits, passing on to the airframe-mounted fuel filter and on to the engine-driven 
fuel pump. 

When the aircraft engine is operating under normal conditions, pilot pressure holds the valve 
open. Statically, when the aircraft is not operating and the engine start fuel boost pump is off, 
fuel is prevented from flowing past the engine firewall by the spillage control valve assembly. In 
the static condition, no fuel pressure (pilot pressure) is available to the spillage control valve 
assembly so the valve remains closed. 

The FAA-certified spillage control valves require more than twice the head pressure produced by 
full fuel tanks, located as high above the valve as is probable in an accident, to open the poppet. 

Under conditions in which sudden engine stoppage is encountered, i.e., blade strike, fuel system 
line failure, or foreign object ingestion, the spillage control valve assembly reacts to the loss of 
pilot pressure and stops fuel flow. The condition of sudden engine stoppage is identical to the 
static condition of the system. 

Normal starting and engine operation on aircraft equipped with the spillage control valve is in 
accordance with the normal aircraft procedure, with the exception that the manual by-pass lever 
of the spillage control valve must be actuated prior to turning on the start fuel boost pump. After 
engine start-up, the manual by-pass lever is returned to the “Normal” position. 

In-flight restart of the engine is also in accordance with the recommended normal aircraft 
procedure, except that the manual by-pass lever must be activated prior to turning on the start 
fuel boost pump. Subsequent to a successful engine restart, the manual by-pass lever is returned 
to the “Normal” position. 

The valve is designed so that failure of pilot fuel pressure to reach the valve, i.e., pilot pressure 
line breakage, will not cause engine stoppage. The valve is sized so that the engine-driven fuel 
pump can pull enough fuel through the spillage control valve to obtain the maximum, as well as 
idle, engine power. Operating with the valve in this mode is similar to operating in the by-pass 
mode of a filter or similar type component. Should the pilot pressure fuel line break (rupture), 
the resulting spillage can be prevented or held to a minimum by incorporating a self-sealing 
breakaway valve, a flow-restricting orifice, or both. 

6.3.10 Nitrogen . 

Diluting the oxygen laden air in the ullage space of a fuel system to the point that it will no 
longer support combustion has been in use for over 60 years. Methods have included the use of 
CO 2 , cleaned aircraft engine exhaust, and nitrogen. 

The catastrophic in-flight explosion of TWA flight 800, a B-747 aircraft, has caused nitrogen 
inerting to once again be seriously considered as a reasonably practical way to reduce the 
likelihood of a fire inside a fuel tank and/or vent system. Pioneered by the military as a means to 
prevent fuel tank explosions following ballistic impacts, it quickly found its way into the 
military’s supersonic SR-71, YF-12, B-70 bomber, and NASA’s X-15 fuel systems as a means of 
controlling ullage fires during heating of the aircraft caused by its various flight profiles. 
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Studies of its behavior indicate that it served that purpose quite well. How it serves to lessen the 
crash fire threat is unknown; however, when a midair collision between the B-70 and an F- 104 
caused both aircraft to crash, an interesting crash observation was made. It appeared to the 
investigators on the scene that the postcrash fire damage, especially in the B-70 wing area, was 
much less than they had anticipated, based on their observations of many other military large 
aircraft crashes. 

Discussions with the on-scene investigators indicated that they felt that the presence of abundant 
nitrogen in the area served to reduce, and in many areas prevent, the start and/or spread of 
postcrash fire. How successful it really was in the postcrash fire episode is unknown. Although 
several investigations have shown that fuel tank inerting offers little or no protection when the 
fuel tank itself is ruptured, this might be an area worthy of further research. 

6.3. 1 1 Electrical System . 

A recent study of nearly all transport airplane fuel systems [90] disclosed many instances of 
electrical wiring inside fuel tanks which was chafed, worn, or frayed. Some of the wires were in 
metal tubes, while others were not even in protective sheathes. While the study focused on 
issues related to in-flight fires and explosions, many of the observations also apply to the crash 
scenario. 

An energized electrical system being tom apart during an aircraft accident can easily ignite 
spilled combustible liquid. While the scope of this study deals primarily with controlling 
spillage, it is worthy of mention that selective routing of electrical wiring can reduce their 
likelihood of providing an ignition source for the spilled combustible. 

6.4 ASSESSMENT OF CURRENT STATUS OF CRFS DESIGN . 

The current status of CRFS design can be assessed from three different aspects: (1) the 
importance a particular item has in the overall system; (2) the technical knowledge available for 
the design of crash-resistant fuel systems and components; and (3) the level of implementation in 
current systems. The authors of this report have attempted to make this assessment, albeit 
arbitrarily, from their perspective of each having over 35 years of experience developing CRFS 
technology. Their assessments are contained in table 6-1, which addresses specific CRFS 
components for large transport aircraft, and in table 6-2, which addresses the correlative factors 
which are necessary for effective CRFS design. 

Both tables list specific components and/or factors that must be considered in CRFS design. In 
table 6-1 (see columns A-D) each component is evaluated with respect to A — how critical this 
particular component is in CRFS design; B — how much knowledge relating to crash resistance is 
available for component design; C — how much crash-resistance knowledge has been 
implemented in actual CRFS designs; and D — how many of the CRFS components are actually 
being used in large transport aircraft. In table 6-2, each factor is evaluated with respect to 
A — how important the particular factor is in crash-resistant design; B — how much knowledge is 
known about the factor which relates to CRFS design; and C — the level of knowledge regarding 
that factor which is currently being used in CRFS design for large transport aircraft. 
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TABLE 6-1 . LARGE TRANSPORT AIRCRAFT CRFS COMPONENTS 


Component 

A 

B 

C 

D 

1.1 Fuel Tanks 

5 




Bladders 


5 


2 

Integral 


2 


2 

Other 


2 

1 

2 

1 .2 Fuel Lines 

5 




Flexible 


4 

4 

3 

Rigid 


4 

3 

2 

1.3 Valves 

4 




Tank selector 


4 

2 

2 

ON/OFF 


4 

2 

2 

Single-point pressure refueling 


4 

2 

2 

Check 


5 

3 

3 

Drain 


5 

3 

3 

Vent 


5 

1 

3 

1 .4 Couplings 

5 




Self-sealing (quick disconnect) 


5 

2 

1 

Self-sealing, breakaway (quick disconnect) 


4 

1 

1 

Self-sealing, breakaway (frangible) 


5 

3 

2 

AN/MS Plumbing 


4 

3 

3 

Nipples 


2 

1 

1 

1.5 Miscellaneous Components 

5 




Pumps 


4 

3 

2 

Filler openings 


5 

3 

2 

Filler caps 


5 

3 

2 

Filters 


3 

3 

2 

Frangible fasteners 


5 

3 

1 

Fuel Quantity sensor 


5 

3 

2 


A = Level of crash-resistance importance 

B = Level of crash-resistance knowledge available for component design 
C = Level of crash-resistance knowledge integrated into component design 
D = Level of CRFS component use in large transport aircraft 

5 = Best/highest 
1 = Worst/lowest 
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TABLE 6-2. FACTORS AFFECTING LARGE TRANSPORT AIRCRAFT CRFS DESIGN 


Factor 

A 

B 

C 

1 . 1 Level of Crash Severity Desired 

5 



Human tolerance 


5 

4 

1 .2 Crash Environment at the Severity Level 




Selected 




Velocity changes at impact 


2 

2 

Structural behavior at impact 

■ 

2 

2 

Impact attitudes and angles 


2 

2 

1 .3 Fuel System Behavior 

5 



Probable fuel spillages 


3 

2 

Probable ignition sources 


3 

3 

1 .4 Fuel Characteristics 

4 



Typical liquid fuels 


5 

mm 

Modified fuels 


2 


1.5 CRFS Standards 

5 


HH 

FAR’s 


2 

mm 

SAE/DOD 


3 

wM 

Design Guides 


4 

Bl 

Advisory Circulars 


4 

wM 

1 .6 Quality and Quantity of Accident Data 

5 



Investigator competence 


2 

2 

Investigator training 


2 

■ 2 

Data storage 


2 

3 

Data retrieval 


2 

3 

Feedback 


2 

2 


A = Level of crash-resistance importance 
B = Level of knowledge related to crash-resistance issues 
C = Level of knowledge being applied 

5 = Best/highest 
1 = Worst/lowest 


Each component or factor is rated in all areas on a scale from 1 to 5, with 1 being the worst or 
lowest level and 5 being the best or most important. For instance, a 5 in column A of both tables 
signifies that this component or factor is of primary importance in CRFS design while a 1 means 
that the component or factor should be considered but does not take precedence over other 
considerations in CRFS design. A 5 in column B of table 6-1 means that the knowledge to 
design a particular crash-resistant component is extensive and complete, in column C that the 
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component is very well designed for crash resistance, or, in column D, that this particular 
component, in a highly crash-resistant configuration, is being extensively used in current large 
transport aircraft. Likewise, a rating of 1 in column B of table 6-2 means that very little 
is known about the factor or that the knowledge is unsatisfactory for CRFS design. A 1 in 
column C of table 6-2 indicates that this factor is not being used effectively to any extent in 
CRFS design. 

Tables 6-1 and 6-2 provide a general idea of areas where future research is most necessary and 
where the implementation of crash-resistant hardware and/or airframe design is most lacking. To 
use the tables for prioritizing or selecting research and/or design projects, the level of importance 
should be of the highest order (e.g., a rating of 5 in column A). Then, for whichever major 
component or factor is selected, the lowest number under column B indicates where more 
research is needed. The lowest number in column C signifies the lowest implementation or 
application of the factor. A low number here indicates a need for design and/or implementation 
of a CRFS component (table 6-1) or better utilization of available knowledge in CRFS design 
(table 6-2). 

In examining table 6-1, several general trends are apparent. Perhaps the most noticeable is that 
all but one of the general component areas have the highest level of importance (5 in column A). 
This reflects the fact that a CRFS must work as a complete system. It is only as effective as its 
weakest link. Also apparent, with only a few exceptions, is that the basic knowledge for CRFS 
component design and implementation is well advanced. One notable exception is the lack of 
CRFS knowledge and technology to incorporate crash resistance into current integral fuel tanks. 

The lower ratings in column C of table 6-1 indicate components incorporating little, if any, 
special crash-resistant features in their design. Some components can be made more crash 
resistant by making them sturdier or redesigning them to reduce their overall vulnerability. The 
latter is usually better, especially if weight is a concern. In the case of fuel tanks, bladders have 
shown to be more crash resistant than other fuel containment concepts thus far developed. 

In table 6-2 the level of knowledge (column B), as well as utilization of that knowledge 
(column C) is shown. Much of the discrepancy between column A and B is due to the lack of 
adequate crashworthiness accident investigations, investigative procedures and accident data 
storage and retrieval. This issue is discussed at length in section 4 of this report. 

The predominant criterion for manufacturers and designers is the level of crash severity that must 
be accommodated by the CRFS. Since the principal objective of the CRFS is to protect the 
aircraft occupants from fire in accidents that approach the limits of survivability due to impact 
forces, the crash environment must be well understood in order to establish the severity level for 
CRFS design. 
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7. FUEL SYSTEM CRASH SURVIVABILITY EVALUATION. 


7.1 POSTCRASH FIRE POTENTIAL RATING SYSTEM . 

The Aircraft Crash Survivability Evaluation process that is part of Aeronautical Design Standard 
(ADS)-llB [91] is designed to numerically relate the crash survival potential of a particular 
aircraft design to what is considered optimum for each specific issue to be rated, e.g., the fuel 
system. Throughout the past 30 years, the rating system has been highly reliable in pinpointing 
potential crash survivability problem areas. This section paraphrases in substantial part, the 
contents of ADS- 1 IB. 

Although ADS-1 IB is part of the U.S. Army’s Survivability Program for Rotary Wing Aircraft, 
the Crash Survivability Evaluation process is applicable to all aircraft, fixed wing as well as 
rotary wing. The numerical ratings, derived primarily from accident data, are valid for both 
helicopter and small fixed-wing aircraft, but would probably be different for large transport 
category aircraft. The process , however, is a valuable tool for fuel system designers and, as 
such, is included in this report. When the quality of accident data for transport aircraft is 
improved, the evaluation items and the point system can be adjusted accordingly. 

The primary objective of the evaluation process is to provide a tool for use during the 
preliminary design phase of new aircraft or for modification to existing aircraft. These early 
evaluations identify problem areas in sufficient time to accomplish design changes with a 
minimum cost in time and dollars. 

The Aircraft Crash Survivability Evaluation is based on the probable performance of an aircraft 
in an upper limit survivable crash, since it is assumed that protection of the occupants to their 
upper limits of human survivability is the major goal in aircraft crashworthiness design. 

When evaluating any aircraft from a crash survival point of view there are six basic factors that 
must be considered. They are: 

1 . Crew Retention System, 

2. Passenger Retention System, 

3. Postcrash Fire Potential, 

4. Basic Airframe Crashworthiness, 

5. Evacuation, and 

6. Injurious Environment. 

In order to develop a reasonable Crash Survivability Rating, weighted values have been assigned 
to the various factors. The percent of weight assigned to each is based on their relative hazard 
potential. The six factors with their hazard potential for small aircraft are shown in table 7-1. 
Although the relative crew/passenger retention system ratings are probably inaccurate for 
transport airplanes, accident data to date seem to show that the postcrash fire hazard does 
account for about one-third of the total crash hazard. It is not unrealistic to think that the overall 
retention system (crew plus passenger) could also account for approximately one-third of the 
total. 
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When performing the rating for small aircraft, the hazard potential percentage has been 
converted to an optimum point value where a perfect score on all six factors would equal 720. 
For existing aircraft not incorporating a crashworthy fuel system, inadequate restraint systems 
and postcrash fire have been equally responsible for injuries and fatalities in accidents so they 
were weighted at approximately 35% each. A poor score on either of these important items 
indicates a critical situation from a crash survival point of view - depending on such variables as 
number of occupants carried, operating terrain, and rescue facilities. 

TABLE 7-1 . AIRCRAFT SURVIVABILITY HAZARD RATING FOR 
HELICOPTERS AND SMALL AIRPLANES 



Hazard 

Potential 

Optimum 

Points 

1 . Crew Retention System 

17.9% 

125 

2. Passenger Retention System 

17.2% 

125 

3. Postcrash Fire Potential 

35.2% 

255 

4. Basic Airframe Crashworthiness 

17.2% 

125 

5. Evacuation 

8.3% 

60 

6. Injurious Environment 

4.2% 

30 

Totals 

100% 

720 


Each of the six factors is in turn broken down into subfactors against which a hazard potential 
percentage has been assigned and converted to an optimum point value. The evaluator selects 
that portion of the optimum point value that each subfactor is worth and lists it accordingly. The 
criteria for the Postcrash Fire Potential Rating subfactors are listed in table 7-2 and discussed 
briefly on the following pages. When rating an aircraft, the subfactors are given a point value 
proportional to the desirable qualities outlined in this discussion. 

7.1.1 Spillage Control . 

7.1.1 .1 Fuel Containment (Optimum = 60 points) . 

a. Location (20% of total value) - 12 points 

The location of the fuel tank should be evaluated with respect to the anticipated impact 
area, occupiable area, large weight masses, and primary ignition sources. 

b. Vulnerability (20% of total value) - 12 points 

The vulnerability of a fuel tank should be evaluated with respect to possible tank ruptures 
caused by various aircraft structural failures, such as landing gear failure and vertical 
column deflection. Tank failures associated with structural displacement, such as 
ruptures around the filler neck, the fuel line entry and exit area, the quantity indicators, 
and the tiedown devices should also be considered. 
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TABLE 7-2. POSTCRASH FIRE POTENTIAL RATING FOR HELICOPTERS AND 

LIGHT AIRPLANES 



Optimum 

Points 

Actual 

Points 

Spillage Control 



Fuel containment 

60* 


Oil containment 

20 


Flammable fluid lines 

30 


Firewall 

9 


Fuel flow interrupters 

9 


Ignition Control 



Induction and exhaust flame location 

30 


Location of hot metals and shielding 

30 


Engine location and tiedown strength 

15 


Battery location and tiedown strength 

12 


Electrical wire routing 

12 


Boost pump location and tiedown strength 

7 


Inverter location and tiedown strength 

6 


Generator location and tiedown strength 

6 


Lights location and tiedown strength 

5 


Antenna location and tiedown strength 

. 4 


Total Points 

255 



* If a range extension system is included in the evaluation, allow 40 points for primary fuel system and 20 
points for the range extension system. 


Construction Technique (50% of total value) - 30 points 

The construction technique is evaluated for two primary considerations. One is tank 
geometry and the other is tank construction materials. 

• Tank Geometry 

Smooth contoured shapes are given the highest number of points, whereas 
irregular shapes and interconnected multicell tanks are given the lowest number 
of points. 

• Cell Material 

The tank is given a certain number of points, depending on its construction. 

Crash Resistant per MIL-T-27422B 30 points 
















1 2 points 


Crash Resistant per MIL-T-5578C 
dated 26 July 1983* 

Metal Canister 6 points 

Integral 3 points 

d. Fuel Boost System (10% of total value) - 6 points 

The fuel boost pump should be evaluated according to its potential for causing fuel 
spillage due to fuel cell rupture or line failure. This includes location and method of fuel 
cell attachment. 

7.1 .1.2 Oil and Hydraulic Fluid Containment (Optimum = 20 points') . 

a. Location (34% of total value) - 7 points 

The location of the oil tank should be evaluated from the standpoint of its proximity to 
the anticipated impact area, occupiable area, large weight masses, and primary ignition 
sources. 

b. Vulnerability (34% of total value) - 7 points 

Evaluate from the standpoint of rupture resistance from other aircraft structure; e.g., 
control linkage failures causing puncture to the tank. 

c. Construction and Tiedown Adequacy (32% of total value) - 6 points 

• Construction Methods 

Construction methods are evaluated in descending order of oil-containing ability. 

Cellular 6 points 

Bladder 4 points 

Sheet Metal 2 points 

• Tiedown Adequacy 

Tiedown should be evaluated primarily on the adequacy of the system to safely 
support the tank during typical crash accelerations. 


MIL-T-5578 deals with self-sealing characteristics of fuel tanks when subjected to various caliber projectiles, and 
does NOT address crash resistance directly. 
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7. 1 . 1 .3 Flammable Fluid Lines (Optimum = 30 points) . 


a. Construction (33% of total value) - 10 points 

The construction of fuel lines should be judged in accordance with the hose material and 
couplings. Experience has shown that rigid lines fail before the flexible type; thus, 
flexible lines with a steel-braided outer sheath are given the most points. Also included 
in this phase of the evaluation are the couplings. The fewer the couplings the better. 
Ninety-degree couplings are less desirable than the straight type. Any coupling is less 
desirable than an uncut hose. Aluminum fittings usually fail before steel ones. 

b. Routing (33% of total value) - 10 points 

The routing of the fuel lines is an important consideration. The lines must not pass 
through areas where they can get trapped, cut, or pulled. Extra hose length (20%-30% in 
areas of anticipated structural deformation) should be provided. Holes through which the 
fuel lines pass should be considerably larger than the outer diameter of the hose. 

c. Breakaway Fittings (33% of total value) - 10 points 

Breakaway fittings or self-sealing breakaway valves should be installed on each fuel line 
that enters and exits the fuel tank. It is also advisable to have them installed at strategic 
locations throughout the system. 

7. 1 . 1 .4 Firewall (Optimum = 9 points) . 

Evaluate the firewall from the standpoint of how well it will function as a shield between crash- 
induced fluid spillage and the various engine ignition sources. 

7. 1 . 1 .5 Fuel Flow Interrupters (Optimum = 9 points) . 

Fuel flow interrupters are devices that block or divert the flow of spilled flammable fluids. 
There are many different methods to perform this function, including baffles, drain holes, drip 
fences, and curtains. 

7.1.2 Ignition Control . 

7. 1 .2. 1 Induction and Exhaust Flame Location (Optimum = 30 points') . 

Evaluate from the standpoint of: 

a. Location of expelled flames in relation to location of spilled flammable liquids. 

b. Fuel ingestion. 
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7. 1 .2.2 Location of Hot Metals and Shielding (Optimum = 30 points) . 


Evaluate from the standpoint of how well the hot items (temperatures above 400°F) are shielded 
or protected from fuel spillage. Components included are: 

a. Engine (external and internal) 

b. Exhaust system 

c. Heater 

d. APU 

7. 1.2.3 Engine Location and Tiedown Strength (Optimum = 15 points') . 

Consider sequences of engine separation. Where will the engine go and how will it affect the 
fuel cell, exhaust system, electrical wiring, and fuel and oil lines? Will the engine come into 
contact with spilled flammable fluids? 

Retention strength is more important for aircraft in which the engine may be located above or 
just behind the fuel cell; it is of less consequence for pod-mounted engines. 

7. 1.2.4 Battery Location and Tiedown Strength (Optimum = 12 points) . 

Evaluate from the standpoint of tiedown strength and of vulnerability of the battery and attached 
wiring to damage during a crash. Location should also be as far as possible from fuel and oil 
tanks and anticipated areas of flammable fluid spillage. 

7.1 .2.5 Electrical Wire Routing (Optimum = 12 points) . 

Evaluate from the standpoint of crashworthiness of routing and vulnerability to damage during 
crash. Some excess length (20%-30%) should be provided to allow for airframe deformation 
during a crash. 

7. 1.2.6 Fuel Boost System (Optimum = 7 points) . 

The fuel boost system should be evaluated with respect to its function as an ignition source. The 
following items should be considered: 

a. Power Supply. (An air-driven pump is best, a hydraulic-driven pump is next best, and an 
electrically driven pump is least desirable.) 

b. Pump Location. (A suction system with the pump located on the engine is best. A pump 
located outside the tank is next best and an internal tank-mounted pump is least 
desirable.) 
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7.1 .2.7 Inverter Location and Tiedown Strength (Optimum = 6 points) . 

Evaluate from the standpoint of tiedown strength and of vulnerability of the inverter and attached 
wiring to damage during crash. Location should be as far as possible from fuel and oil tanks and 
anticipated areas of flammable fluid spillage. 

7. 1.2.8 Generator Location and Tiedown Strength (Optimum = 6 points) . 

Evaluate from the standpoint of tiedown strength and of vulnerability of the generator and 
attached wiring to damage during a crash. Location should be as far as possible from fuel and oil 
tanks and anticipated areas of flammable fluid spillage. 

7. 1.2.9 Lights (Beacons, Search, and Navigation) (Optimum = 5 points) . 

Are the light filament and/or wires immediately surrounding the light attachments in the area of 
possible flammable fluid spillage? 

7.1.2.10 Antenna Location (Optimum = 4 points) . 

Evaluate the antenna systems and their respective wiring from the standpoint of vulnerability to 
damage and location in the areas of possible flammable fluid spillage. 

7.2 FUEL SYSTEM FIRE HAZARD LEVEL REDUCTION . 

The previous section discussed the postcrash fire survivability factors and ratings criteria for 
aircraft fuel and electrical systems. This section presents a more detailed postcrash fire 
evaluation based on a rating system that has been used to determine the percent of the total fire 
hazard attributable to selected fuel system components overall and/or for a specific damage- 
prone area containing potentially hazardous fuel system components [92]. An example of an 
overall components evaluation in a hypothetical transport airplane fuel system is included to 
illustrate how the evaluation process is used to reduce the fire hazard level of the fuel system. 

7.2.1 Evaluation Criteria and Process. 


7.2. 1.1 General . 

Now that truly crash-resistant fuel system knowledge exists and, in fact, is installed in most U.S. 
military helicopters, and crashworthy hardware is available from many aerospace manufacturers, 
the fuel system designer is confronted with the problem of trying to determine how much fire 
safety can (or should) be included in any given aircraft type, size, or fuel system design. An 
evaluation technique has been developed which allows a fuel system design to be evaluated to 
determine the relative fire hazard level for each component and/or hazardous area. Proposed 
crashworthy design changes can then be integrated into the original design and the system re- 
evaluated to determine the fire hazard level reduction. This process allows the designer to make 
intelligent trade-offs, when necessary, in the fuel system design to achieve the desired reduction 
in the postcrash fire hazard. 
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For the evaluation to be performed, several assumptions must be made to establish a baseline or 

starting point. They are 

a. The only fire threat being evaluated is the one from the fuel system. (The cargo, oils, 
etc., are not included in this evaluation, although they, too, could be evaluated if they 
were included in the evaluation process.) 

b. The fire threat associated with the original fuel system is the basis from which the fuel 
system improvements are to be measured. As an example, the overall fire threat 
associated with the original fuel system is assumed to be 100%. Improvements in fuel 
system design are measured in percentage of reduction from the original 100% fire 
hazard level. 

c. . In order to evaluate the behavior of various fuel system designs, a crash environment that 

is typical of the serious, marginally survivable accident should be used as the basic 
reference point. 

d. The evaluator must be skilled in accident investigation and reconstruction, fuel system 
design, aircraft and aircraft systems behavior during crash situations, and crash-resistant 
design. 

The evaluation process is performed in the following manner: 

a. The original fuel system is defined, and the various component and/or hazardous areas 
are noted, as shown in figure 7-1 and in table 7-3. 

b. Each identified component or hazardous area in the original fuel system is evaluated in 
accordance with the rating system (defined below) to determine its relative fire hazard 
level. 

c. The original fuel system design is modified to incorporate various crashworthy hardware 
and/or design changes, and then re-evaluated in accordance with the rating system to 
determine the fire hazard level reductions attributable to the improved design. 

Note: The original fuel system may be upgraded by the addition of only one crashworthy 

improvement or by the addition of many crashworthy improvements. Each upgraded 
system must be evaluated as a complete system to determine the fire hazard level 
reduction attributable to separate design changes. The reason for the complete re- 
evaluation of each upgraded system is that the changing of one or more components 
and/or hazardous areas can, and usually does, influence the behavior of the remaining 
components and/or hazardous areas. 
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A - Wing Tanks 
B - Center Wing Tank Zone 
C - Under Floor Zone, Except B 
D - Engine Zone 
E - Main Landing Gear Zone 


FIGURE 7-1. HYPOTHETICAL TRANSPORT AIRPLANE FUEL SYSTEM WITH THE 
COMPONENTS AND HAZARDOUS AREAS IDENTIFIED 
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TABLE 7-3. SAMPLE HYPOTHETICAL FUEL SYSTEM FIRE HAZARD LEVEL 

UNMODIFIED ORIGINAL 


Item 

Description 

Percent 

FCS 1 

Percent 

LSCF 2 

Points 

FSOF 3 

Points 

EET 4 

Hazard 

Units 5 

Fire 

Hazard 

Level 6 

Percent 

Hazard 

Reduction 7 

i 

Filler openings 

50 

50 

8 

8 

4.00 

5.45 

N/A 

2 

Tanks 

50 

80 

10 

10 

8.00 

10.90 

N/A 

3 

Outlets 

90 

90 

10 

10 

16.20 

22.07 

N/A 

H 

13 



10 

10 

9.00 

12.26 

N/A 

5 

Fuel lines (tank-to- 
engine) 

80 

30 

8 

8 

3.84 

5.23 

N/A 

6 

Valves (selector) 

80 

75 

10 

7 

10.20 

13.90 

N/A 

7 

Valves (firewall 
shutoff) 

75 

75 

10 

7 

9.56 

13.02 

N/A 

8 

Filters 

20 

75 

10 

6 

2.40 

3.27 

N/A 

9 

Pumps 

80 

75 

10 

7 

10.20 

13.90 

N/A 


Totals 

73.4 

100.0 



Notes: 

1 . FCS = Likelihood of a component to fail and cause 
spillage 

2. LSCF = Likelihood of spillage catching fire 

3. FSOF = Likelihood of fire starting other fires 

4. EET = Numeric code representing estimated escape time 
for occupants 

5. Hazard Units = (FCS/100 x LSCF/100) x (FSOF + EET) 

7.2. 1.2 The Rating System . 

The rating system evaluates the following four items: 

a. The likelihood of fuel spillage occurring from the designated components and/or 
hazardous areas during the serious, marginally survivable crash. 

b. The likelihood of fuel spillage from the designated component/area catching fire. 

c. The likelihood of an existing fire that started at a designated component/area functioning 
as an ignition source for other probable spillages in other designated areas. (The chain 
reaction situation.) 

d. The probable escape time available to occupants if a fire occurs at a designated 
component/area. 


6. Fire Hazard Level = 

Hazard Units (by item) x 100 
Hazard Units (total unmodified) 

7. Percent Fire Hazard Reduction = 

Basic Hazard Level - Modified Hazard Level x 100 
Basic Hazard Level 
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7.2. 1.2.1 Failure of a Component Which Causes Spillage . 


When rating the fuel system components and/or hazardous areas for the likelihood of fuel 
spillage during the serious, marginally survivable crash, the following items should be included 
in the evaluation: 

a. Vulnerability of the component and/or area during impact. 

• Location 

• Specific component or area design 

b. Probability that a destructive impact will occur. Each designated component/area is rated 
in each specific system configuration. The rating is given in the form of percentage of 
probable spillage occurrence. Example: If the designated component/area will cause 
spillage during every serious crash, it is given a 100% rating, whereas if it will cause 
spillage in only one out of every four accidents, it is given a rating of 25%. 

7.2. 1 .2.2 Likelihood of Spillage Catching Fire . 

When rating the fuel system components and/or hazardous areas for the likelihood of fuel 
spillage catching fire, the following items should be included in the evaluation. 

a. Availability of ignition sources 

• Type 

• Available energy and duration 

• Location 

b. Size of fuel spill 

c. Probable spillage paths 

Spillage occurring at each designated component/area is rated in each specific system 
configuration. The rating is given in the form of percentages of probable ignition. 

Example: If the spillage will catch fire every time during the serious crash environment, it is 
given a 100% rating. If it will ignite in only one out of every four accidents, it is given a rating 
of 25%. 

7.2. 1.2.3 Fire Starting Other Fires . 

When rating the fuel system components and/or hazardous areas for the likelihood of an existing 
fire serving as an ignition source for other spillages, the following items should be included in 
the evaluation: 

a. Location of fire 

b. Size of fire 

c. Location of other ignitable material 

d. Possible spillage paths 

e. Possible flame spread paths 
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Each fire is rated in each specific system configuration. The rating is given in the form of points. 
If an existing fire is 90% to 100% likely to ignite surrounding spillages, a rating of 10 is given. 
If the likelihood of an ignition chain reaction is 80% to 90%, a rating of 9 is given. The point 
rating decreases at the rate of 1 point per each 10% decrease in likelihood of occurrence, as 
shown below. 


Likelihood of Fire 
Starting Other Fires 
Rating Points 

10 

9 

8 

7 

6 

5 

4 

3 

2 

1 


Reaction Occurrence 

90 - 100% 

80 - 90% 

70 - 80% 

60 - 70% 

50 - 60% 

40 - 50% 

30 - 40% 

20 - 30% 
10 - 20 % 
0 - 10 % 


7.2.1 .2.4 Estimated Escape Time . 

When rating the fuel system components and/or hazardous areas for the probable escape time 
available to occupants if a fire occurs, the following items should be included in the evaluation: 

a. Location of initial fire relative to the occupants 

b. Growth potential of the fire 

• Initial spillage quantity 

• Sustained spillage quantity 

c. Egress considerations 

• Location of occupants relative to the escape routes 

• Complexity of the escape (doors, hatches, handles, cargo, and other potentially 
delaying problems) 

Each fire is rated in each specific system configuration. The rating is given in the form of points. 
If the escape time is estimated to be less than 20 seconds, the fire is given a rating of 10. If the 
escape time is more than 20 seconds, but less than 40 seconds, the fire is rated 9. The point 
rating decreases at the rate of 1 point for each 20 second increase in escape time as shown below. 


7-12 


Rating Points 


Available Escape Time 


0-20 seconds 
20 - 40 seconds 
40 - 60 seconds 
60 - 80 seconds 
80 - 100 seconds 
100 - 120 seconds 
120 - 140 seconds 
140 - 160 seconds 
160 - 180 seconds 
180 - 

For a discussion of why 180 seconds is chosen as the maximum time duration, see Escape Time 
Discussion, section 7.2. 1.3. 

7.2. 1.2.5 Hazard Units . 

Hazard units are arbitrary numbers derived by the following formula. 

(FCS/100 x LSCF/100) x (FSOF + EET) 

Rating in percent for each component/area when evaluated for the likelihood of the 
component “failing and causing spillage.” 

Rating in percent for each component/area when evaluated for the “likelihood of the 
spillage catching fire.” 

Rating in points for each fire when evaluated for the likelihood of “fire starting other 
fires.” 

Rating in points for each fire when evaluated for “estimated escape time” for 
occupants. 

7.2. 1 .2.6 Fire Hazard Level . 

The fire hazard level is 100% for the complete, original fuel system design. For a specific 
component and/or designated area it is derived by the following formula: 

FHL = Component and/or area hazard units x 100 
Total System hazard units 


FCS = 
LSCF = 
FSOF = 
EET = 


10 

9 

8 

7 

6 

5 

4 

3 

» 2 

1 


7.2.1 .3 Escape Time Discussion . 

The length of time required for evacuation from a crashed aircraft can differ for a variety of 
reasons. Examples include ratio of occupants to usable exits, ease of exit operation, interference 
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problems with things such as cargo, fire, etc., the degree of occupant injury, and the availability 
of rescue personnel. 

Studies by the authors of this report and others of aircraft crash fire growth rates and of 
evacuation times used by survivors in over 4,500 air crashes have shown that most evacuations 
fall into one of two categories. Either the occupants are out of the aircraft within a few seconds 
to a minute or two, or they are in the aircraft for a much longer period of time — in some cases 
hours or days. 

The growth rates of typical postcrash fires are such that they usually start out small, grow in 
intensity for several minutes, then start to subside. Man’s ability to survive these fires is usually 
predicated on the clothing he is wearing, the air he is breathing, the temperature to which he is 
being exposed, and the duration of his exposure. 

A summary of actual crash data, as well as experimental crash test data, indicates that three 
minutes is about as long as one can expect to survive in a major crash fire. In fact, the survival 
time will be much less in many crashes, due primarily to the close proximity of the fuel to the 
occupants. 

For further study of the subject, the reader is referred to the scientific literature, much of which is 
summarized in volume v of the U.S. Army “Aircraft Crash Survival Design Guide,” 
USAAVSCOM TR 89-D-22E [86], coauthored by the authors of this report. It is the basic 
handbook in the field and is available from the U.S. National Technical Information Service. 

7.2.2 Example Fuel System Fire Hazard Level Evaluation . 

The fuel system used as an example is shown in figure 7-1 . 

7.2.2. 1 Fuel System Fire Hazard Level— Original System . 

The original fuel system hazard level is shown in table 7-3. The fuel system items were 
evaluated in accordance with the procedures described under section 7.2.1. The table shows that 
the original fuel system has a total fire hazard level of 100%, and that the 100% level was 
derived from a hazard unit level of 73.4. 

Study of the individual fire hazard level percentage clearly shows that item 3, fuel tank outlet, is 
the principal contributor to the fire problem. Items 4, 6, 7, and 9 are also major contributors, 
while Items 1, 2, 5, and 8 are much less hazardous. 

7.2.2.2 Fuel System Fire Hazard Level — Modified System . 

Once the evaluation process yields the fire hazard level for the original fuel system, design 
change options are theorized which, if implemented, will reduce the overall fire threat. For 
example, item 3 could be modified to greatly reduce fuel spillage during a crash by (1) using 
crash-resistant high-strength fittings in the tanks, (2) installing self-sealing breakaway valves at 
the couplings between the tanks and fuel lines and, (3) making the fuel lines from flexible, longer 
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hose to accommodate relative displacement between fuel system components. The rating for 
item 3 might be as shown in table 7-4, resulting in a fire hazard reduction of 99.8 percent for this 
one item only. However, the changes made would also reduce the fire hazard level of the fuel 
lines (item 4) by 75.1 percent, as shown in table 7-4. The effect of these changes would reduce 
the fire hazard level of the overall fuel system by 3 1 percent. 


TABLE 7-4. SAMPLE HYPOTHETICAL FUEL SYSTEM FIRE HAZARD LEVEL- 

MODIFIED 


Item 

Description 

Percent 

FCS 1 

Percent 

LSCF 2 

Points 

FSOF 3 

Points 

EET 4 

Hazard 

Units 5 

Fire 

Hazard 

Level 6 

Percent 

Hazard 

Reduction 7 

i 

Filler openings 

50 

50 

8 

8 

4.00 

5.45 

0 

2 

Tanks 

50 

80 

10 

10 

8.00 

10.90 

0 

3 

Outlets 

10 

10 

2 

1 

0.03 

0.04 

99.8 

4 

Fuel lines (tank-to-tank) 

20 

70 

8 

8 

2.24 

3.05 

75.1 

5 

Fuel lines(tank-to- 
engine) 

80 

30 

8 

8 

3.84 

5.23 

0 

6 

Valves (selector) 

80 

75 

10 

7 

10.20 

■fen 

0 

7 


75 

75 

10 

7 

9.56 



8 

Filters 

20 

75 

10 

6 

2.40 

3.27 

0 

9 


80 

75 

10 

7 


13.90 

0 


Totals 

50.47 

68.76 

31.24 


Notes: 

1 . FCS = Likelihood of a component to fail and cause 
spillage 

2. LSCF = Likelihood of spillage catching fire 

3. FSOF = Likelihood of fire starting other fires 

4. EET = Numeric code representing estimated escape time 
for occupants 

5. Hazard Units = (FCS/100 x LSCF/100) x (FSOF + EET) 


6. Fire Hazard Level = 

Hazard Units (by item) x 100 
Hazard Units (total unmodified) 

8. Percent Fire Hazard Reduction = 

Basic Hazard Level - Modified Hazard Level x 100 
Basic Hazard Level 
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8. REGULATORY ISSUES. 


8.1 INTRODUCTION . 

Title 14 CFR Part 25 — Airworthiness Standards: Transport Category Airplanes — originated as 
the recodification of CAR Part 4b following establishment of the Federal Aviation 
Administration by the Federal Aviation Act of 1958 (72 Stat. 731). In the 40+ years since its 
inception, 14 CFR Part 25 has been upgraded continually attempting to maintain currency with 
technological progress. Along the way it has been necessary for the FAA to issue Advisory 
Circulars (AC) to supplement the CFRs, principally defining acceptable means for compliance 
with the regulatory mandates. As the plethora of certification paperwork needed to supplement 
the actual CFRs grew, it became evident that designers, manufacturers, modifiers, operators, and 
even FAA certification officials themselves needed simpler access to certification history. 

The FAA recently began a process by which historic certification documentation would be 
compiled into a series of documents according to category. Popularly titled “Mega-ACs,” the 
program’s initial products have been AC 29-2B (now - 2C) for Transport Rotorcraft certificated 
under 14 CFR Part 29, AC 27-1 A for Normal Category Rotorcraft certificated under 14 CFR Part 
27, and two of a proposed set of five ACs for Transport Category Airplanes certificated under 14 
CFR Part 25 (see section 8.3.4 below). The initial round of Mega-ACs experienced some 
formatting and content quality inconsistencies between regional certification directorates. 
However, the ASW Rotorcraft Certification Directorate’s revision of AC 29-2B to 29-2C in 2 
years, incorporating major changes fed back from its constituency, demonstrates that these 
documents can be forged into much more user-friendly reference documents. It is believed that 
the FAA’s efforts to collect all available certification data into a series of Mega-ACs will lead to 
greater productivity and less ambiguity than exist using the “old” system. 

8.2 EXISTING 14 CFR PART 25 COVERAGE. 


Amendment 25-91 [93] most recently amended §25.561 by increasing the “ultimate inertial 
forces” specified under which transport airplane structures must provide protection for occupants 
in a “minor crash landing” (not otherwise defined): 

8.2. 1 Subpart C-Structure — Emergency Landing Conditions . 

FAR §25.561 General. 

(a) The airplane, although it may be damaged in emergency landing conditions on land 
or water, must be designed as prescribed in this section to protect each occupant 
under those conditions. 

(b) The structure must be designed to give each occupant every reasonable chance of 
escaping serious injury in a minor crash landing when - 

(1) Proper use is made of seats, belts, and all other safety design provisions; 

(2) The wheels are retracted (where applicable); and 
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(3) The occupant experiences the following ultimate inertia forces acting 
separately relative to the surrounding structure: 

(i) Upward, 3.0 g 

(ii) Forward, 9.0 g 

(iii) Sideward, 3.0 g on the airframe; and 4.0 g on the seats and their 
attachments. 

(iv) Downward, 6.0 g 

(v) Rearward, 1.5 g 

(c) For equipment, cargo in the passenger compartments and any other large masses, 
the following apply: 

(1) Except as provided in paragraph (c)(2) of this section, these items must be 
positioned so that if they break loose they will be unlikely to: 

(i) Cause direct injury to occupants; 

(ii) Penetrate fuel tanks or lines or cause fire or explosion hazard by damage 
to adjacent systems; or 

(iii) Nullify any of the escape facilities provided for use after an emergency 
landing. 

(2) When such positioning is not practical (e.g., fuselage mounted engines or 
auxiliary power units) each such item of mass shall be restrained under all 
loads up to those specified in paragraph (b)(3) of this section. The local 
attachments for these items should be designed to withstand 1.33 times the 
specified loads if these items are subject to severe wear and tear through 
frequent removal (e.g., quick change interior items). 

(d) Seats and items of mass (and their supporting structure) must not deform under any 
loads up to those specified in paragraph (b)(3) of this section in any manner that 
would impede subsequent rapid evacuation of occupants. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Arndt. 25-23, 35 FR 5673, Apr. 8, 
1970; Arndt. 25-64, 53 FR 17646, May 17, 1988; Arndt. 25-91, 62 FR 40706, July 29, 1997] 

8.2.2 Other FAR Part 25 Sections . 

Of the other 18 regulatory sections of 14 CFR Part 25 which apply to crashworthiness design 
issues affecting postcrash fires, four were updated in 1977, two in 1984, and one each in 1990, 
1989, 1978, and 1972. The remaining eight are more than 30 years old. The significance of the 
superannuity of those design criteria lies in the fact that 1970 marked the transition to CRFSs in 
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the U.S. Army’s helicopter fleet. Their introduction minimized unnecessary carnage generated 
by postcrash fires which resulted from spillage after fuel system damage in otherwise survivable 
accidents. Statistical study and advisory committee recommendations issued subsequent to the 
U.S. Army’s rotorcraft initiatives have borne little fruit. (See other sections of this report.) The 
dearth of state-of-the-art CRFS design criteria in 14 CFR Part 25 compares poorly to the FAA’s 
initiative in advancing rotorcraft CRFS design in 14 CFR Part 27, Normal Category Rotorcraft, 
and Part 29, Transport Category Rotorcraft. 

8.2.2. 1 Landing Gear . 

§ 25.721 General. 

(a) The main landing gear system must be designed so that if it fails due to overloads 
during takeoff and landing (assuming the overloads to act in the upward and aft 
directions), the failure mode is not likely to cause - 

(1) For airplanes that have passenger seating configuration, excluding pilots seats, 
of nine seats or less, the spillage of enough fuel from any fuel system in the 
fuselage to constitute a fire hazard; and 

(2) For airplanes that have a passenger seating configuration, excluding pilots 
seats, of 10 seats or more, the spillage of enough fuel from any part of the fuel 
system to constitute a fire hazard. 

(b) Each airplane that has a passenger seating configuration, excluding pilots seats, of 
10 seats or more must be designed so that, with the airplane under control, it can be 
landed on a paved runway with any one or more landing gear legs not extended 
without sustaining a structural component failure that is likely to cause the spillage 
of enough fuel to constitute a fire hazard. 

(c) Compliance with the provisions of this section may be shown by analysis or tests, 
or both. 

[Arndt. 25-32, 37 FR 3969, Feb. 24, 1972] 

8.2.2.2 Fuel System . 

§ 25.963 Fuel tanks: general. 

(a) Each fuel tank must be able to withstand, without failure, the vibration, inertia, 
fluid, and structural loads that it may be subjected to in operation. 

(b) Flexible fuel tank liners must be approved or must be shown to be suitable for the 
particular application. 

(c) Integral fuel tanks must have facilities for interior inspection and repair. 
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(d) Fuel tanks within the fuselage contour must be able to resist rupture and to retain 
fuel, under the inertia forces prescribed for the emergency landing conditions in § 
25.561. In addition, these tanks must be in a protected position so that exposure of 
the tanks to scraping action with the ground is unlikely. 

(e) Fuel tank access covers must comply with the following criteria in order to avoid 
loss of hazardous quantities of fuel: 

(1) All covers located in an area where experience or analysis indicates a strike is 
likely must be shown by analysis or tests to minimize penetration and 
deformation by tire fragments, low energy engine debris, or other likely 
debris. 

(2) All covers must be fire resistant as defined in part 1 of this section. 

(f) For pressurized fuel tanks, a means with fail-safe features must be provided to 
prevent the buildup of an excessive pressure difference between the inside and the 
outside of the tank. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Arndt. 25-40, 42 FR 15043, Mar. 
17, 1977; Arndt. 25-69, 54 FR 40352, Sept. 29, 1989] 

§ 25.965 Fuel tank tests. 

(a) It must be shown by tests that the fuel tanks, as mounted in the airplane, can 
withstand, without failure or leakage, the more critical of the pressures resulting 
from the conditions specified in paragraphs (a)(1) and (2) of this section. In 
addition, it must be shown by either analysis or tests, that tank surfaces subjected to 
more critical pressures resulting from the condition of paragraphs (a)(3) and (4) of 
this section, are able to withstand the following pressures: 

(1) An internal pressure of 3.5 psi. 

(2) 125 percent of the maximum air pressure developed in the tank from ram 
effect. 

(3) Fluid pressures developed during maximum limit accelerations, and 
deflections, of the airplane with a full tank. 

(4) Fluid pressures developed during the most adverse combination of airplane 
roll and fuel load. 

(b) Each metallic tank with large unsupported or unstiffened flat surfaces, whose 
failure or deformation could cause fuel leakage, must be able to withstand the 
following test, or its equivalent, without leakage or excessive deformation of the 
tank walls: 
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(1) Each complete tank assembly and its supports must be vibration tested while 
mounted to simulate the actual installation. 

(2) Except as specified in paragraph (b)(4) of this section, the tank assembly must 
be vibrated for 25 hours at an amplitude of not less than 1/32 of an inch 
(unless another amplitude is substantiated) while 2/3 filled with water or other 
suitable test fluid. 

(3) The test frequency of vibration must be as follows: 

(i) If no frequency of vibration resulting from any rpm within the normal 
operating range of engine speeds is critical, the test frequency of 
vibration must be 2,000 cycles per minute. 

(ii) If only one frequency of vibration resulting from any rpm within the 
normal operating range of engine speeds is critical, that frequency of 
vibration must be the test frequency. 

(iii) If more than one frequency of vibration resulting from any rpm within 
the normal operating range of engine speeds is critical, the most critical 
of these frequencies must be the test frequency. 

(4) Under paragraphs (b)(3) (ii) and (iii) of this section, the time of test must be 
adjusted to accomplish the same number of vibration cycles that would be 
accomplished in 25 hours at the frequency specified in paragraph (b)(3)(i) of 
this section. 

(5) During the test, the tank assembly must be rocked at the rate of 16 to 20 
complete cycles per minute, through an angle of 15° on both sides of the 
horizontal (30° total), about the most critical axis, for 25 hours. If motion 
about more than one axis is likely to be critical, the tank must be rocked about 
each critical axis for 12 1/2 hours. 

(c) Except where satisfactory operating experience with a similar tank in a similar 
installation is shown, nonmetallic tanks must withstand the test specified in 
paragraph (b)(5) of this section, with fuel at a temperature of 1 10° F. During this 
test, a representative specimen of the tank must be installed in a supporting 
structure simulating the installation in the airplane. 

(d) For pressurized fuel tanks, it must be shown by analysis or tests that the fuel tanks 
can withstand the maximum pressure likely to occur on the ground or in flight. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Arndt. 25-11, 32 FR 6913, May 5, 
1967; Arndt. 25-40, 42 FR 15043, Mar. 17, 1977] 
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§ 25.967 Fuel tank installations. 


(a) Each fuel tank must be supported so that tank loads (resulting from the weight of 
the fuel in the tanks) are not concentrated on unsupported tank surfaces. In 
addition - 

(1) There must be pads, if necessary, to prevent chafing between the tank and its 
supports; 

(2) Padding must be nonabsorbent or treated to prevent the absorption of fluids; 

(3) If a flexible tank liner is used, it must be supported so that it is not required to 
withstand fluid loads; and 

(4) Each interior surface of the tank compartment must be smooth and free of 
projections that could cause wear of the liner unless - 

(i) Provisions are made for protection of the liner at these points; or 

(ii) The construction of the liner itself provides that protection. 

(b) Spaces adjacent to tank surfaces must be ventilated to avoid fume accumulation due 
to minor leakage. If the tank is in a sealed compartment, ventilation may be limited 
to drain holes large enough to prevent excessive pressure resulting from altitude 
changes. 

(c) The location of each tank must meet the requirements of § 25. 1 1 85(a). 

(d) No engine nacelle skin immediately behind a major air outlet from the engine 
compartment may act as the wall of an integral tank. 

(e) Each fuel tank must be isolated from personnel compartments by a fumeproof and 
fuelproof enclosure. 

§ 25.975 Fuel tank vents and carburetor vapor vents. 

(a) Fuel tank vents. Each fuel tank must be vented from the top part of the expansion 
space so that venting is effective under any normal flight condition. In addition - 

(1) Each vent must be arranged to avoid stoppage by dirt or ice formation; 

(2) The vent arrangement must prevent siphoning of fuel during normal 
operation; 

(3) The venting capacity and vent pressure levels must maintain acceptable 
differences of pressure between the interior and exterior of the tank, during - 

(i) Normal flight operation; 
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(ii) Maximum rate of ascent and descent; and 

(iii) Refueling and defueling (where applicable); 

(4) Airspaces of tanks with interconnected outlets must be interconnected; 

(5) There may be no point in any vent line where moisture can accumulate with 
the airplane in the ground attitude or the level flight attitude, unless drainage 
is provided; and 

(6) No vent or drainage provision may end at any point - 

(i) Where the discharge of fuel from the vent outlet would constitute a fire 
hazard; or 

(ii) From which fumes could enter personnel compartments. 

(b) Carburetor vapor vents. Each carburetor with vapor elimination connections must 
have a vent line to lead vapors back to one of the fuel tanks. In addition - 

( 1 ) Each vent system must have means to avoid stoppage by ice; and 

(2) If there is more than one fuel tank, and it is necessary to use the tanks in a 
definite sequence, each vapor vent return line must lead back to the fuel tank 
used for takeoff and landing. 

§ 25.993 Fuel system lines and fittings. 

(a) Each fuel line must be installed and supported to prevent excessive vibration and to 
withstand loads due to fuel pressure and accelerated flight conditions. 

(b) Each fuel line connected to components of the airplane between which relative 
motion could exist must have provisions for flexibility. 

(c) Each flexible connection in fuel lines that may be under pressure and subjected to 
axial loading must use flexible hose assemblies. 

(d) Flexible hose must be approved or must be shown to be suitable for the particular 
application. 

(e) No flexible hose that might be adversely affected by exposure to high temperatures 
may be used where excessive temperatures will exist during operation or after 
engine shut down. 

(f) Each fuel line within the fuselage must be designed and installed to allow a 
reasonable degree of deformation and stretching without leakage. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Arndt. 25-15, 32 FR 13266, Sept. 
20, 1967] 
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§ 25.994 Fuel system components. 

Fuel system components in an engine nacelle or in the fuselage must be protected 
from damage which could result in spillage of enough fuel to constitute a fire 
hazard as a result of a wheels up landing on a paved runway. 

[Arndt. 25-57, 49 FR 6848, Feb. 23, 1984] 

§ 25.995 Fuel valves. 

In addition to the requirements of § 25.1 189 for shutoff means, each fuel valve 
must - 

(a) [Reserved] 

(b) Be supported so that no loads resulting from their operation or from accelerated 
flight conditions are transmitted to the lines attached to the valve. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Arndt. 25-40, 42 FR 15043, Mar. 
17, 1977] 

§ 25.997 Fuel strainer or filter. 

There must be a fuel strainer or filter between the fuel tank outlet and the inlet of 
either the fuel metering device or an engine driven positive displacement pump, 
whichever is nearer the fuel tank outlet. This fuel strainer or filter must - 

(c) Be mounted so that its weight is not supported by the connecting lines or by the 
inlet or outlet connections of the strainer or filter itself, unless adequate strength 
margins under all loading conditions are provided in the lines and connections. 

[Arndt. No. 25-36, 39 FR 35460, Oct. 1, 1974, as amended by Arndt. 25-57, 49 FR 6848, Feb. 
23, 1984] 

§ 25.999 Fuel System Drains. 

(b) Each drain required by paragraph (a) of this section must - 
(3) Have a drain valve - 

(ii) That is either located or protected to prevent fuel spillage in the event of 
a landing with landing gear retracted. 

[Doc. No. 5066, 29FR18291, Dec. 24, 1964 as amended by Arndt. 25-38, 41FR55467, Dec. 20, 
1976] 
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8.2.2.3 Oil System . 


§ 25.1013 Oil tanks. 

Installation. Each oil tank installation must meet the requirements of § 25.967. . .. 

(c) Filler connection. Each recessed oil tank filler connection that can retain any 
appreciable quantity of oil must have a drain that discharges clear of each part of 
the airplane. In addition, each oil tank filler cap must provide an oiltight seal. 

(d) Vent. Oil tanks must be vented as follows: 

Each oil tank must be vented from the top part of the expansion space so that 
venting is effective under any normal flight condition. 

(f) Flexible oil tank liners. Each flexible oil tank liner must be approved or must be 
shown to be suitable for the particular application. 

[Doc. No. 5066, 29 FR 18291, Dec. 24, as amended by Arndt. 25-19, 33 FR 15410, Oct. 17, 
1968; Arndt. 25-23, 35 FR 5677, Apr. 8, 1970; Arndt. 25-36, 39 FR 35460, Oct. 1, 1974; Arndt. 
25-57, 49 FR 6848, Feb. 23, 1984; Arndt. 25-72, 55 FR 29785, July 20, 1990] 

§25.1017 Oil lines and fittings. 

(a) Each oil line must meet the requirements of § 25.993 and each oil line and fitting in 
any designated fire zone must meet the requirements of § 25. 1 1 83. 

(b) Breather lines must be arranged so that - 

(1) Condensed water vapor that might freeze and obstruct the line cannot 
accumulate at any point; 

(2) The breather discharge does not constitute a fire hazard if foaming occurs or 
causes emitted oil to strike the pilot's windshield; and 

(3) The breather does not discharge into the engine air induction system. 

8.2.3 Subpart F - Equipment - 

General 


§ 25.1309 Equipment, systems, and installations. 

(a) The equipment, systems, and installations whose functioning is required by this 
subsection, must be designed to ensure that they perform their intended functions 
under any foreseeable operating condition. 
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(b) The airplane systems and associated components, considered separately and in 
relation to other systems, must be designed so that - 

(1) The occurrence of any failure condition which would prevent the continued 
safe flight and landing of the airplane is extremely improbable, and 

(2) The occurrence of any other failure conditions which would reduce the 
capability of the airplane or the ability of the crew to cope with adverse 
operating conditions is improbable. . .. 

(d) Compliance with the requirements of paragraph (b) of this section must be shown 
by analysis, and where necessary, by appropriate ground, flight, or simulator tests. 
The analysis must consider - 

(1) Possible modes of failure, including malfunctions and damage from external 
sources. 

(2) The probability of multiple failures and undetected failures. 

(3) The resulting effects on the airplane and occupants, considering the stage of 
flight and operating conditions. ... 

[Arndt. 25-23, 35 FR 5679, Apr. 8, 1970, as amended by Arndt. 25-38, 41 FR 55467, Dec. 20, 
1976; Arndt. 25-41, 42 FR 36970, July 18, 1977] 

§ 25.1453 Protection of oxygen equipment from rupture. 

Oxygen pressure tanks, and lines between tanks and the shutoff means, must be - 

(a) Protected from unsafe temperatures; and 

(b) Located where the probability and hazards of rupture in a crash landing are 
minimized. 

8.3 OTHER FAA AND DEPARTMENT OF TRANSPORTATION (DOT) GUIDANCE 
MATERIAL . 

8.3.1 Advisory Circular 25.994-1 : Design Considerations to Protect Fuel Systems During a 
Wheels Up Landing f941 . 

AC 25.994-1 was issued in July 1986 in response to “...inquiries [which] made it obvious that a 
description of the wheels up landing condition and the maximum loads to be used for the fuel 
system components should have been established.” [Authors’ Note: The inquiries were 

submitted shortly after 14 CFR §25.994 was incorporated into the regulations by Amendment 
25-23 in April 1970. The FAA offers no explanation for the 16-year delay.] 
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AC 25.994-1 presents the following guidance: 

4. Discussion 

Section 25.994 requires that the fuel system components in an engine nacelle or in 
the fuselage be protected from damage which could result in the spillage of 
enough fuel to constitute a fire hazard. Fuel is the most likely cause of a fire 
following a wheels up landing if the fuel system components in the engine 
nacelles and the fuselage are damaged to the extent that fuel is released. 
Therefore, the location and routing of fuel system components in the engine 
nacelle and fuselage should be evaluated with respect to the runway scraping 
action that may be encountered and the resultant structural distortion that may 
occur. The components which cannot be located to protect them from likely 
damage in a wheels up landing should be designed to minimize fuel spillage and 
leakage into zones of possible or likely ignition sources. The probable migration 
of fuel should be evaluated and those zones where fuel is likely to enter should 
not have potential ignition sources. Equipment in such areas should be explosion 
proof, hermetically sealed, or otherwise qualified to operate in a flammable fluid 
leakage zone. 

Fuel system components and likely ignition sources (electrical arcing and high 
temperature surfaces (above 400°F)) that should be investigated include fuel 
shutoff valves, couplings, fittings, lines, electrical wiring, electric power cables, 
electric motors, electric motor driven pumps, hot air conditioning ducts and 
engine bleed air ducts. Many of these components are installed in, or routed 
through areas susceptible to damage resulting from a wheels up landing. 

For the purposes of this AC, a wheels up landing is defined as a landing on a 
paved runway under a controlled emergency landing condition as described in 
Sec. 25.561 . The damage that may be sustained in a full gear up landing or other 
failed configurations, such as one or two gears extended or all gears collapsed, 
cannot be precisely determined. However, a reasonable design effort to protect 
fuel system components for the all wheels up landing should minimize the extent 
of component damage for the other gear failure configurations. 

5. Acceptable Means of Compliance 

The airplane fuel system should be designed to minimize the spilling or leaking of 
fuel from damaged components during and following a wheels up landing. The 
unpreventable release of fuel, such as from severed or punctured fuel lines 
downstream from shutoff valves, should be diverted or excluded to the maximum 
extent practicable from spreading to likely ignition sources. 

Fuel lines and fuel system components should be located and routed as far as 
practicable from likely impact areas where structural deformation may cause 
crushing, severing, punctures or high tensile loads in the lines. 
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Fuel lines should be constructed to protect their integrity during and after a 
wheels up landing. Flexible and stretchable hoses should be used and the fuel line 
should be designed to allow stretching or movement with the deformed structure 
up to an amount likely to be required to prevent failure under high tensile or shear 
loading. Flexible hoses should also be designed and qualified to absorb the 
energy that would likely be imparted to the component or fuel line from direct 
impact resulting from structural failure. 

Fuel lines and fuel system components within the engine nacelle should be 
arranged and protected to the maximum extent possible so that spilled fuel caused 
by damage to lines or components from a wheels up landing is not likely to 
contact hot engine surfaces (over 400°F). Fuel lines and components should be 
shrouded and drained to accomplish this protection. 

In areas of the engine nacelles, pylons, and airplane fuselage that are susceptible 
to being damaged by a wheels up landing, fuel lines and electrical wiring should 
be isolated, separated and routed to the maximum extent practicable, to minimize 
the hazards of spilled fuel flowing into an area containing a potential ignition 
source. In addition, electrical components should be acceptable for operation in 
flammable leakage zones identified in accordance with Sec. 25.863. 

Shielding and drainage may be used wherever it is considered appropriate to 
prevent spilled fuel from spreading to potential ignition sources or occupied areas. 

Drip fences and drainage troughs can be used to divert flow of spilled fuel from 
potential ignition sources such as hot engine cases, electrical accessories, and 
component compartments. Nonconductive material should be used to shroud 
electrical wiring that might be damaged by deforming structure. 

Fuel shutoff valves should not be located within engine nacelles, pylon areas or 
adjacent to engine air intakes and exhausts where they may be subjected to 
damage from impact and scraping action during a wheels up landing. Fuel shutoff 
valve mountings should, as a minimum, be designed for the inertial loads listed in 
Sec. 25.561 unless the location and estimated loads in the area impose a greater 
strength requirement to maintain the shutoff valve mounting integrity. 

Installation of auxiliary fuel tanks and systems in the fuselage should be based on 
the guidance and information in AC 25-8, Auxiliary Fuel System Installations. 

It is instructive to compare the content of Advisory Circular 25.994-1, which is merely advisory 
“guidance” for airworthiness design of transport category airplanes, with the content of 14 CFR 
§§27.952 and 29.952, which are identical regulatory requirements for airworthiness design of 
normal and transport category rotorcraft, respectively; e.g.,: 

Fuel line self-sealing breakaway couplings. Self-sealing breakaway couplings 
must be installed unless hazardous relative motion of fuel system components to 
each other or to local rotorcraft structure is demonstrated to be extremely 
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improbable or unless other means are provided. The couplings or equivalent 
devices must be installed at all fuel tank-to-fixel line connections, tank-to-tank 
interconnects, and at other points in the fuel system where local structural 
deformation could lead to the release of fuel. 

Frangible or deformable structural attachments. Unless hazardous relative motion 
of fuel tanks and fuel system components to local rotorcraft structure is 
demonstrated to be extremely improbable in an otherwise survivable impact, 
frangible or locally deformable attachments of fuel tanks and fuel system 
components to local rotorcraft structure must be used. The attachment of fuel 
tanks and fuel system components to local rotorcraft structure, whether frangible 
or locally deformable, must be designed such that its separation or relative local 
deformation will occur without rupture or local tearout of the fuel tank or fuel 
system components that will cause fuel leakage. [Emphases added by the authors 
of this report] 

8.3.2 Advisory Circular 25.963-1 : Fuel Tank Access Covers T951. 

AC 25.963-1 was issued in July 1992 to provide guidance for complying with the certification 
requirements of 14 CFR Part 25.963(e) for fuel tank access covers for turbine-powered transport 
category airplanes. 14 CFR Part 25.963(e) was incorporated by Amendment 25-69, 54 FR 
40352, Sept. 29, 1989, following a fatal accident at Manchester, UK, in which debris penetrated 
underwing fuel tank access covers of a B-737 following engine failure, causing massive fuel 
spillage and subsequent fire. (See section 4) 

AC 25.963-1 provides the following guidance: 

4. Impact Resistance 

All fuel tank access covers must be designed to minimize penetration and 
deformation by tire fragments, low energy engine debris, or other likely debris, 
unless the covers are located in an area where service experience indicates a strike 
is not likely. [AUTHORS’ NOTE: Note that this “not likely” evaluation 

criterion is inconsistent with criteria set forth in FAR §25.1309 and AC 23.1309- 
1C; e.g., “probable,” “improbable” or “extremely improbable”.] The rule does 
not specify rigid standards for impact resistance because of the wide range of 
likely debris which could impact the covers. The applicant should, however, 
choose to “minimize penetration and deformation” by testing covers using debris 
of a type, size, trajectory, and velocity that represent conditions anticipated in 
actual service for the airplane model involved. The access covers, however, need 
not be more impact resistant than the contiguous tank structure. 

The requirement that the impact resistance of the tank access cover be equivalent to the impact 
resistance of “the contiguous tank structure” is illogical unless one considers merely the 
condition in which the tanks are integral to the structure. For example, the impact resistance of 
an integral tank access cover should logically replicate the impact resistance of the skins which 
form the tank wall. It does not follow that an access cover over a CRFS-qualified bladder tank 
should demonstrate impact resistance equal to that of the bladder tank. 
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8.3.3 Advisory Circular 25-8: Auxiliary Fuel System Installations l~96] . 

AC 25-8 was issued on May 2, 1986. It provides guidance on acceptable means of compliance 
with FAR requirements for installation of auxiliary fuel systems in transport category airplanes. 
AC 25-8 defines “Auxiliary fuel system” as: 

... a system installed within the airplane which makes additional fuel available 
for increasing the flight range of that airplane. The term ‘auxiliary’ means that 
this system is secondary to and backed by the airplane’s essential fuel system, 
i.e., that the functions of the essential fuel system are immediately available and 
operative without immediate supervision by the flight crew in the event of failure 
or inadvertent depletion of fuel in the auxiliary fuel system (reference 
§25. 955(b)(2)). In essence, an airplane equipped with an auxiliary fuel system is 
capable of safe flight even when the auxiliary fuel system is not used, i.e., where 
its fuel storage capacity is not required for short range flight. (AC 25-8; 
Appendix 1) 

Despite substantial and detailed guidance on design, construction, installation, and use of 
auxiliary fuel systems, AC 25-8 is strangely silent with reference to known (and proved) 
standards for crash-resistant fuel system design. For example. Chapter 1 of AC 25-8, titled “Fuel 
System Installation Integrity and Crashworthiness,” contains no references whatsoever to CRFS 
design, evaluation, and testing criteria established in MIL-STD-1290A [97], TR-89-D22E, 
Aircraft Crash Survival Design Guide, [86], ADS-11 [91] or AJDS-36 [98]. Although these 
documents are admittedly directed specifically toward rotary-wing aircraft crashworthy fuel 
systems, the principles therein are universally applicable. In particular, the Postcrash Fire 
Potential Rating methodology of ADS-11 and ADS-36’s methods for testing fuel systems, 
subsystems, and components could easily be adapted to provide more robust criteria for 
evaluating the crash-resistant design of auxiliary fuel systems in transport category airplanes. 

Detailed CRFS component design criteria contained in MIL-T-27422B [30] on the subject of 
crash-resistant fuel tanks, and other standards relating to valves and hoses and their preferred 
installation parameters, could potentially be as effective in mitigating some postcrash fires in 
transport category airplanes as they have been in helicopters. It was considered significant that 
the SAE G-9 Fuel Tank Bladder Sub-Committee has reached consensus on a new fuel tank 
specification (MIL-PRF-27422) that essentially reiterates the technical details of MIL-T-27422B. 

8.3.4 New FAA Advisory Circulars Pertaining to Transport Airplane Certification: The Mega- 

ACs. ' ’ ~ " ’ " “ ~ ‘ 


The Mega- AC concept came to fruition subsequent to the demise of NPRM 89-11 (see section 
8.4.4). During efforts to “normalize” airworthiness regulations with the European Community 
(EC), FAA management became aware that many previously accepted means for regulatory 
compliance had never been memorialized in a format conveniently accessible by entities who 
need to use the information. The objective of the Mega-AC initiative was to compile all known 
historic information on regulatory intent, and currently accepted certification practices, into 
single-source documents available to all potential users. 
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The first attempted Mega-AC on the market was AC 29-2B, relating to transport category 
rotorcraft, which was released on July 30, 1997. Subsequent feedback led to a streamlined and 
more user-friendly AC 29-2C and AC 27-1B for normal category rotorcraft. 

Five transport airplane Mega-ACs are contemplated by the FAA ANM Transport Airplane 
Certification Office. (See reference 99 paragraph 4.a., p. II.) Each will address one technical 
regulatory area pertaining to transport airplanes: 

Certification of Transport Airplane Structure (AC 25-21); 

Certification of Transport Airplane Mechanical Systems (AC 25-22); 

Certification of Electrical Equipment Installation (Proposed AC 25-XX); 

Transport Airplane Propulsion Engine and Auxiliary Power Unit Installation Certification 
Handbook (Proposed AC 25-XX); and 

Transport Airplane Cabin Interiors Handbook (Proposed AC 25- 17 A). 

According to the FAA/ A VR/ AIR web site, at this writing (July 2000) only ACs 25-21 and 25-22 
have been issued. Comment period closed on February 4, 2000, for AC 25-17A, Transport 
Airplane Cabin Interiors Handbook. A draft of Mega-AC 25-XX, Transport Airplane Propulsion 
Engine and Auxiliary Power Unit Installation Certification Handbook, was issued for which the 
comment period closed on December 29, 1999. At some 1200 pages, this draft Mega- AC was 
criticized for being unwieldy and cumbersome. It has been temporarily withdrawn, although the 
full text is available on the FAA web site. The web site contains no current status for AC 25- 
XX, Certification of Electrical Equipment Installation. 

The FAA plans an additional Mega-AC 33-XX pertaining to aircraft engines. 

8.3.4.1 Advisory Circular 25-21 : Certification of Transport Airplane Structure f 1001 . 

AC 25-21, dated September 1, 1999, has as its purpose to provide: 

...methods acceptable to the Administrator for showing compliance with the 
provisions of subparts C and D of 14 CFR part 25 regarding the type certification 
requirements for transport airplane structure. This AC is intended to provide 
guidance to airplane manufacturers, modifiers, foreign regulatory authorities, and 
Federal Aviation Administration (FAA) transport airplane type certification 
engineers and their designees. The methods and procedures described herein have 
evolved over many years and represent current certification practice. Like all 
advisory material, these guidelines are not mandatory and do not constitute 
regulations. They are derived from previous FAA experience in finding 
compliance with the airworthiness requirements and represent methods and 
procedures found to be acceptable by that experience. 
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Among AC 25-21 ’s related documents specified in paragraph 3 therein, are: 

• Title 14 Code of Federal Regulations (14 CFR). Sections which prescribe 
requirements for the design, substantiation, and certification of airplane structure, 
landing gear, and control systems include all sections within subpart C, Structure 
and subpart D, Design and Construction, except for the crashworthiness standards 
listed in Sections 810-819. 

• Industry Documents. Military specification handbooks relevant to flight 
vehicles. 

AC 25-21 also incorporates material relating to other Title 14 CFR sections outside of those 
subparts: 

• Subpart E - Powerplant: §25.963 - Fuel Tanks: General 

• Subpart G - Operating Limitations and Information: 

- §25.1517 -Rough Air Speed, Vra 

- §25. 1 529 and Appendix H - Instructions for Continued Airworthiness 

AC 25-21 guidance refers only to three of the 14 CFR Part 25 sections previously cited as 
relevant to transport airplane design factors affecting fuel system crashworthiness and postcrash 
fires: 


• Subpart C - Structure: Emergency Landing Conditions — §25.561- General 

• Subpart D - Design and Construction: Landing Gear — §25.721 - General 

• Subpart E - Powerplant: Fuel Tanks — §25.963 - General 

Unfortunately, AC 25-21 offers very little in the way of guidance toward an acceptable means of 
compliance for any of these sections. For example, in addition to the text of the FAR sections 
cited, AC 25-21 adds the following “guidance” material: 

• For FAR §25.561: 

b. Intent of Rule . The purpose of this rule is to ensure that occupants will have a 
reasonable chance of escaping serious injury after an emergency landing on either 
land or water. 

c. Background . This rule was carried forward from § 4b.260 of the Civil Air 
Regulations (CAR). Amendment 25-23 made minor editorial changes for 
clarification. Amendment 25-64 increased the inertia load factors in the upward, 
sideward, and downward directions and added a rearward load factor. 
Amendment 25-64 also removed the reference to the five f.p.s. ultimate descent 
velocity. Amendment 25-91 provided a factor of 1.33 for frequently removed 
items. 
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d. 


Acceptable Compliance Methods . For guidance on compliance with this 
requirement, refer to the preamble of Amendment 25-23, 35 FR 5673, April 8, 
1970; Amendment 25-64, 53 FR 17646, May 17, 1988; and Amendment 25-91, 
62 FR 40702, July 29, 1997. 

• References. None. 

Attempts to locate any implementation guidance for FAR §25.561 in Amendment 25-91 (the 
latest applicable regulatory revision) proved futile. The Amendment merely alludes in passing to 
the revision’s newly imposed structural load limits, noting the purpose of the change was to 
achieve harmonization with European regulators via the Joint Airworthiness Requirements 
(JARs). 

• For FAR §25.721: 

Intent of Rule . The purpose of this rule is to insure that if the landing gear fails due to 

overloads during takeoff and landing, the failure itself will not cause the spillage of 

enough fuel from any part of the fuel system to constitute a fire hazard. 

Background . This rule was added by Amendment 25-15 (Sept. 20, 1967). Amendments 

25-23 2532 (sic) extended the application of the rule to include all fuel systems. 

e. Acceptable Compliance Methods . For guidance on compliance with this 
requirement, refer to the preamble of Amendment 25-15, 32 FR 13262, 
September 20, 1967; Amendment 25-23, 35 FR 5676, April 8, 1970; and 
Amendment 25-32, 37 FR 3969, February 24, 1972. [AUTHORS’ NOTE: None 
of these Amendments are readily available via Internet, or any other easily 
accessible source. See below.} 

f. References . None 

• For FAR §25.963: 

b. Intent of Rule. The purpose of this rule is to ensure structural integrity of the fuel 
tanks under all likely operating conditions, including emergency landing 
conditions. 

c. Background. This rule was carried forward from § 4b. 420 of the Civil Air 
Regulations (CAR). Amendment 25-40 removed the requirements pertaining to 
the augmentation liquid tank capacity. Amendment 25-69 added the requirements 
pertaining to fuel tank access covers. 

d. Acceptable Compliance Methods. Advisory Circular (AC) 25-963-1, or latest 
revision, provides guidance information for showing compliance with the impact 
and fire resistance requirements of 25.963(e). Fuel tank access covers must be 
fire resistant and meet the impact criteria specified in Advisory Circular 25.963-1, 
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or latest revision. Compliance with this requirement may be shown by test(s) 
and/or analysis. 


References . Advisory Circular 25.963-1, or latest revision, Fuel Tank Access Covers, 
and AC 25-XX, Transport Airplane Propulsion, Engine, and APU Certification 
Handbook. 

Searches for text of early CFR Amendments or issues of the Federal Register at easily accessible 
locations proved fruitless. The U.S. Government Printing Office Internet site contains references 
from 1994 forward only. Summit Aviation’s Computerized Aviation Reference Library CD 
contains references from 1990 forward only. According to the GPO Access Support Team, 
official federal regulatory documents issued prior to 1994 “...may be available at a Federal 
Depository Library.” (emphasis added by the authors of this report) Historical FAA/GPO paper- 
copy subscription services remain available as a source for complete revision histories of 
selected Parts of the FARs. These documents should be made available publicly via the Internet. 

8.3.4.2 Advisory Circular 25-22: Certification of Transport Airplane Mechanical Systems T991 . 

The stated purpose of AC 25-22, dated March 14, 2000, is to provide “. . . methods acceptable to 
the Administrator for showing compliance with the type certification requirements for transport 
airplane mechanical systems and equipment installations.” AC 25-22 opens at 14 CFR 25.671 in 
the control systems subdivision of Subpart D — Design and Construction, of 14 CFR Part 25 and 
encompasses 46 CFR sections through §25.1529: “Instructions for Continuing Airworthiness.” 

Of title 14 CFR sections previously cited as relating to CRFS, only §§25.1309, 25.1450, and 
25.1453 are cited in AC 25-22. 

Comments at 48.d. (pp. 128-130) relating to 14 CFR 25.1309 appear to raise more questions than 
they answer about the acceptability of competing methodologies for demonstrating compliance 
with certification criteria (e.g., qualitative vs. quantitative): 

Policv/Compliance Methods . The term “subsection” in §25. 1309(a) is intended to 
cover not only subsection “C”, but also the equipment, systems, and installations not 
specifically required by subsection “C” but installed in airplanes in order to engage 
in operations covered by other subsections. Dependence for safety of flight might be 
placed on installations not otherwise mentioned in the rules. 

Probability of a Fire . The following is extracted from an FAA memorandum, dated 
March 9, 1995. This is in response to a request for guidance regarding the use of the 
probability of a fire in a failure analysis when showing compliance with §25.1309. 

The focus of the request was directed at the three issues addressed below: 

The first issue concerns whether the occurrence of a cargo compartment fire should 
be considered to have a probability of one, or something less than one. Advisory 
Circular (AC) 25. 1309-1 A, paragraph 8e, “Operational and Environmental 
Conditions”, allows that random conditions may be considered to have a probability 
of occurrence less than one, and may usually be included in a safety analysis. The 
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AC indicates that a random condition is a condition for which the airplane is not 
designed, and in which the airplane is not normally approved to operate. It also 
indicates that a random condition may be used in the analysis even when the system 
under analysis is designed to protect against the occurrence of the random condition. 
The AC provides, as an example, that it would be reasonable and rational to use a 
probability of less than one of encountering hazardous turbulence or gust levels after 
the failure of a structural load alleviation system. A probability less than one of fire 
occurring after a failure of the fire protection system is similar to this example, and 
may be used in the analysis. Advisory Circular 25. 1309-1 A also provides counter- 
examples for conditions which should not be considered random, and for which a 
probability of one should be used. These are conditions for which the airplane is 
designed. The examples provided, instrument meteorological conditions and 
Category III weather operations, are conditions in which the airplane would be 
expected to operate as a matter of course, and for which operational approval would 
be granted. 

The second issue concerns what value less than one should be assigned to the 
probability of occurrence of a fire. Advisory Circular 25.1309-1A, paragraph 8e, 
provides guidance that the statistically-derived probability used in the analysis 
should be based on an applicable supporting database and a valid statistical 
distribution. When requesting approval for the use of the probability of a random 
condition in a safety analysis, it is incumbent on the applicant to supply the data, 
show the applicability of the database from which the data is supplied, and derive a 
valid statistical conclusion. The ACO (Aircraft Certification Office) should then 
evaluate the applicant’s statistical information and determine if the value used in the 
analysis is supported by the data presented. This value must be reassessed for 
subsequent programs, as service experience gained in the future may require the 
probability of the occurrence to be re-evaluated. 

The third issue is whether the required safety level reached through the use of the 
Maintenance Steering Group, Revision 3 (MSG-3) procedures is higher than that 
reached using a §25.1309 analysis. We contend that this is not so, and that a like- 
comparison of the two sets of procedures is not valid. The §25. 1309 analysis process 
is directed at assessing the contributions of failures to given failure conditions, and to 
directing the airplane or system design appropriately. The MSG-3 process is 
directed at determining appropriate maintenance actions given the contribution of a 
failure to a reduction in safety. Findings from the §25.1309 analysis process are 
used as starting points for certain MSG-3 processes to determine maintenance 
activities and intervals, or whether the maintenance process can adequately minimize 
the risk elements assigned to it. The MSG-3 procedures must assume the 
combination of a system failure with the occurrence of the condition, which the 
system was designed to protect against, in order to account for hidden failures when 
determining maintenance actions. Expected or allowable probabilities related to 
system failures are not derived through the MSG-3 process. In applying the above 
guidance, note that §25.1309 is a rule of general applicability, and should not be used 
to replace a more specific and stringent requirement. Cargo compartments, and 
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compartment fire detection and protection systems must meet requirements specified 
in §§25.855, 25.857, and 25.858, regardless of probabilities as determined in a 
§25.1309 related analysis. 

Examp les. For an example of compliance with §25. 1309(c), see paragraph d(l) 
under §25.1441, Oxygen equipment and supply, of this AC. Another example of 
compliance is included under paragraph d(2), §25.855, Cargo or baggage 
compartments, of this AC. 

Safe and Reliable . The following is extracted from an FAA memorandum dated 
October 26, 1990, and addresses an inquiry regarding (i) the meaning of “Safe and 
reliable” used in §§25. 109(b) and 25.125(b)(3) in terms of AC 25.1309-1A 
probability, and (ii) the acceptable failure probability for deceleration devices like 
anti-skid and ground spoilers that have relatively large and small effects on landing 
distance. The FAA response follows: 

Safe and reliable is generally used to mean that a failure condition is improbable. In 
terms of AC 25. 1309-1 A quantitative probability terms, improbable failure 
conditions are those having a probability on the order of 1 X 10' 5 or less. 

Each deceleration device, such as anti-skid and ground spoilers, would be expected 
to have a failure condition that is at least improbable (i.e. 1 X 10‘ 5 or less) regardless 
of its effect on stopping distance. 

8.3.4.3 Advisory Circular 25-17A: Transport Airplane Cabin Interiors Crashworthiness 
Handbook IT Oil . 

The comment period for proposed AC 25-17A closed on February 4, 2000. 

Its predecessor, AC 25-17 [102], issued July 15, 1991, specified the following distinction: 

Airworthiness design objectives pertain to the ability of the airframe to withstand 
design loads, or to maintain safety of flight of the airplane relative to its 
operational environment. Crashworthiness design objectives pertain to safety of 
the occupants relative to the airplane. Some aspects of crashworthiness , for 
example, fuel tank/system design, fuselage deformation and prevention of 
postcrash fires, are beyond the scope of this AC. (emphasis added by the authors 
of this report) 

The FAA ANM Project Manager for AC 25-17A advised that he anticipates no change to that 
applicability. 

AC 25-17 contains a definition for survivable crash which seemingly oversimplifies factors 
involved in accidents involving transport airplanes: 

A survivable crash environment prevails when the cabin occupants are subjected 
to crash forces within human tolerance levels, and the structural integrity of the 
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passenger space remains intact such that the occupants can rapidly evacuate the 
airplane. 

Although suitable for rotorcraft and small airplanes in which crash forces are distributed 
relatively evenly across the airframe, the definition fails to account for the widely variant force 
distribution across the fuselage of a large transport airplane. It is not unlikely that all occupants 
of one section of a crashed transport airplane perish, while almost all passengers in a different 
section survive. The Survivability Chain mathematical model developed by RGW Cherry & 
Associates Ltd enables scientific evaluation of differing degrees of survivability in the same 
accident. [60] 

8.3.4.4 FAA-Proposed Advisory Circular (AC) 25-XX Transport Airplane Propulsion Engine 
and Auxiliary Power Unit Installation Certification Handbook: The Propulsion Mega- AC IT 031 . 

The September 1999 draft of Proposed AC 25-XX, “The Propulsion Mega-AC” states, as its 
purpose, to provide: 

...methods acceptable to the Administrator for showing compliance with the type 
certification requirements for transport airplane propulsion engine and auxiliary 
power unit (APU) installations. 

...to airplane manufacturers, modifiers, foreign regulatory authorities, and...(FAA) 
airplane type certification engineers. 

The methods and procedures described therein have evolved through many years and 
represent current certification practice. 

AC 25-XX incorporates the substance of the following Advisory Circulars relevant to the subject 
of this report, which would be cancelled by its issuance: 


AC 25-8: Auxiliary Fuel System Installation (May 5, 1986) 

AC 25.963-1: Fuel Tank Access Covers (July 29, 1992) 

AC 25.994-1: Design Considerations to Protect Fuel Systems during a Wheels- 

Up Landing (July 24, 1986) 

Sections of AC 25-XX which contain guidance relevant to this report are: 


Subpart E, 


Section 2: Fuel System 

Section 3: Fuel System Components 

Section 4: Oil System 

Section 9: Powerplant Fire Protection 


Subpart F, Section 25.1309 Equipment, systems and installation 
Appendix 3 Fuel System Certification Checklist 
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Subpart E, Section 2, encompasses the following relevant subsections, keyed to corresponding 
sections of Part 25 of 14 CFR: 

§25.952 Fuel system analysis and test 

§25.963 Fuel tanks, general 

§25.965 Fuel tank tests 

§25.967 Fuel tank installations 

§25.973 Fuel tank filler connection 

§25.975 Fuel tank vents and carburetor vapor vents 

Subpart E, Section 3, encompasses the following relevant subsections, keyed to corresponding 
sections of Part 25 of 14 CFR: 

§25.993 Fuel system lines and fittings 

§25.994 Fuel system components 

§25.995 Fuel valves 

§25.997 Fuel strainer or filter 

§25.999 Fuel system drains 

Subpart E, Section 4, encompasses the following relevant subsections, keyed to corresponding 
sections of Part 25 of 14 CFR: 

§25.1015 Oil tank tests 

§25.1017 Oil lines and fittings 

§25.1025 Oil valves 

Subpart E, Section 9, includes the following relevant subsection, corresponding to a section of 
Part 25 of 14 CFR: 

§25.1189 Shutoff means 

Subpart F, Section 1, includes the following relevant subsection, corresponding to a section of 
Part 25 of 14 CFR: 

§25.1309 Equipment, systems, and installations 

Appendix 3: Fuel System Certification Checklist, was developed by the FAA’s Small Airplane 
Directorate (ACE) to be used “...for safety meetings, Type Certificate (TC), Amended TC, and 
Supplemental Type Certificate (STC) compliance inspections; and initial or special type board 
meetings.” It is a qualitative checklist and includes the following evaluation points relevant to 
this report: 

§b. Vent Systems 

(11) When vent lines connect engine components (carburetors, fuel injectors, etc.) 
to a fuel tank expansion space, a fractured vent will not pour fuel into the 
engine compartment fire zone on a crash landing or rollover. 
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§d. Hardware and Components 

(9) Are flexible hoses used to account for expected differential motion or 
deflections...? 

§f. Crashworthiness 

(1) Is a crashworthiness evaluation report of fuel system planned which shows 
that precautions have been taken to minimize hazards due to a survivable 
crash environment? 

(2) If aircraft upsets in pitch or rollover, is fuel system designed to prevent fuel 
spills from vents or lines which could cause a fire hazard? 

(3) Is system crashworthy with adequate slack in lines to permit large engine 
shifts in survivable accidents (to 16 Gs) without severing lines or 
connections? 

(4) Are self-sealing valves or frangible fittings used where breakaways near 
ignition sources are likely in survivable crash? 

(5) In the event of a wheels-up landing, can fuel tanks, shutoff valve[s], drain 
valves, etc., fracture, and are adjacent ignition sources, such as electrical 
components explosion proof or hermetically sealed? Axe flexible and 
stretchable hoses used? (AC 25.994-XX) 

(6) Are fuel system components and engine mounts strong enough to be 
nonhazardous in a survivable crash (of 8-16 Gs) even though the current rules 
call for 3-4.5 Gs download? 

(9) Are fuel tanks located behind spars or structure to provide for crash and 
ignition protection? 

§i. Fuel Tanks 

(7) Bladders will not normally collapse or tear due to rapid altitude changes, hard 
landing, blocked vents, etc., nor deflect from inadequate support or negative 
pressures that can lead to erroneous fuel quantity sensing or loss or fuel. 

(8) Are bladders and their supports structurally applicable to prevent collapse or 
fracture? TSO or better? 

The ANM Transport Airplane Directorate plans to develop a similar checklist tailored to the 
requirements of Part 25 airplanes. 

The authors of Proposed AC 25-XX commendably make frequent reference to rotorcraft ACs 
27-1B and 29-2B (AC 29-2C was issued subsequent to the issuance of Proposed AC 25-XX) 
where the content of those documents is relevant. These cross-cultural referrals can be valuable 
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for exposing alternative means of compliance on issues which are applicable to more than one 
vehicle species. The draft AC has been temporarily withheld to allow additional time for 
industry comment. It is available publicly at http://www.faa.gov/avr/air/ for download and 
comment. Click on “draft advisory circulars” on pulldown menu. 

8.4 PRIOR GOVERNMENT INITIATIVES TOWARD IMPROVING CRFS AND MITIGATING 
POSTCRASH FIRES IN PART 25 AIRPLANES . 

8.4.1 U.S. Department of Transportation Report to Congress: Systems and Techniques for 
Reducing the Incidence of Postcrash Fuel System Fires and Explosions f521 . 

The Department of Transportation’s Report to Congress: Systems and Techniques for Reducing 
the Incidence of Post-Crash Fuel System Fires and Explosions (December 1988) was delivered 
to the Congress in January 1989. It responded to requirements established by the Airport and 
Airway Safety and Capacity Expansion Act of 1987 (PL 100-223). The Act required the DOT to 
conduct a study of aircraft design and equipment which minimized the incidence of postcrash 
fuel system fires or explosions. 

The FAA study which preceded the DOT report considered 11 methods for reducing the 
postcrash fire and explosion hazard in transport category airplanes: 

Crash-resistant fuel tanks and breakaway, self-closing fittings 

Engine ignition suppression systems 

Fuel tank nitrogen inerting systems 

Fuel tank foam filler explosion suppression systems 

Fuel tank chemical agent explosion suppression system 

Anti-misting kerosene (AMK) 

Fuel tank vent flame arrestor 

Surge tank chemical agent explosion suppression system 
Design to assure fuel tank-to-engine shutoff valve activation 
Fire-resistant fuel tank access panels 
Revised location of fuel tanks and engines 

All but the last alternative were under active consideration at the time, and various alternatives 
had been studied from time to time since 1964. Early initiatives had given priority to in-flight 
explosion prevention over postcrash fires and their effect on survivability. (There is legitimate 
question whether that priority was based on experiential data.) 

The FAA issued NPRM 74-16 in 1974 to require explosion prevention systems in transport 
airplanes. Industry responses were quick to point out that explosion prevention systems would 
be ineffective in reducing postcrash fire hazards in otherwise impact-survivable accidents, 
conditions which posed significantly greater risk to occupants than in-flight tank explosions. 
Following public hearings in 1977, NPRM 74-16 was withdrawn and the FAA established the 
Special Aviation Fire and Explosion Reduction (SAFER) Committee to investigate methods for 
improving post-crash survivability. 


’ Risk = (Probability of Occurrence) X (Severity of the Specified Hazard). 
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8.4.2 Advanced Notice of Proposed Rulemaking (ANPRM) 84-17 . 

The SAFER Committee proposed the following regulatory changes, in order of priority: 

Amend FAR Part 25 to require fuel tank vent protection during ground fires. 

(Subsequently withdrawn) 

Amend FAR Part 25 to require design practices which maximize the 

probability of engine fuel supply shut off in potential fire situations. (Limited 

to redundant manual shut off methods) 

ANPRM 84-17 was issued in the U.S. Federal Register on September 26, 1984 (49 FR 38078). 
Its purpose was to obtain public comments, information, and data relating to adding new 
airworthiness standards for transport category airplane fuel systems that would provide 
protection against fuel tank explosions following postcrash ground fires and assure engine and 
APU fuel supplies would be shut off to reduce fire hazards from spilled fuel. 

8.4.3 Aviation Safety Research Act of 1988 (PL 100-5911 . 

The Aviation Safety and Research Act of 1988 [104] was enacted during the rulemaking period 
for NPRM 84-17. It required the FAA Administrator to issue an ANPRM to determine the 
feasibility of installing crashworthy fuselage fuel tanks and fuselage fuel lines in air carrier 
airplanes. The FAA subsequently published ANPRM 89-1 1 to fulfill that requirement. 

8.4.4 Advanced Notice of Proposed Rulemaking (ANPRM) 89-11 . 

ANPRM 89-1 1 was issued on May 2, 1989 [105]. It was an outgrowth of prior FAA attempts to 
explore methods for mitigating postcrash fires which had theretofore met with little acceptance. 
Responses to ANPRM 89-11 led the FAA’s Northwest-Mountain Region Transport Airplane 
Directorate to draft NPRM 89-1 1A proposing the following amendments to 14 CFR Part 25: 

§25.963 Fuel tanks: General [Revise paragraph (d) to read]: 

(d) Fuel tanks within the fuselage contour must be able to resist leakage and to retain 
fuel, under the inertia forces prescribed for the emergency landing conditions of 
§25.561. In addition, these tanks must be located in a protected position so that 
exposure to penetration or damage due to fuselage deformation, fuselage 
separation, displaced structural members (including the landing gear), and 
scraping action with the ground is unlikely. 

§25.993 Fuel system lines and fittings [Revise paragraph (f) and add new paragraph (g)] 

(f) Each fuel line routed outside the fuel tank walls, and within or adjacent to the 
fuselage, must be designed and installed to resist leakage when the line is 
stretched and deformed by adjacent structure during fuselage separation. This 
capability must be shown with the fuel line at the environmental and operating 
conditions determined to be critical. 
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(g) Each fuel line that is routed outside the fuel tank walls must provide a means to 
either: 

(1) shut off the supply of fuel during takeoff and landing, or 

(2) have an automatic means to shut off the fuel supply during fuselage or 
engine separation. 

§25 .1189 Shutoff means. [Add new paragraph (i)] 

(i) The airframe-mounted engine and auxiliary power unit (APU) fuel shutoff 
valves must isolate the airplane fuel supply from the engine and APU during 
both the normal and emergency shutdown sequence. 

NPRM 89-1 l’s issuance was overtaken by higher priorities within the FAA. The NPRM was 
relegated to inactive status in November 1995. The draft NPRM 89-1 1A incorporated many of 
the comments and suggestions submitted by the 24 ANPRM 89-1 1 commenters and is included 
in this report as appendix B. Unfortunately, its existence was only learned about during the final 
weeks of this research effort; consequently no meaningful criticisms or suggestions are offered at 
this time. The ANM Transport Airplane Directorate plans to issue the NPRM when priorities 
permit. 

8.5 INDUSTRY AND MILITARY PUBLICATIONS. STANDARDS. AND SPECIFICATIONS . 

Although most relevant industry and military guidance is directed specifically toward rotary- 
wing aircraft crashworthy fuel systems, the principles therein are universally applicable. The 
FAA’s adoption of many industry and military crashworthiness-related standards in its guidance 
for transport category rotorcraft, AC 29-2 (Series), should be an exemplar for adaptation of 
known effective technology to transport category airplane applications. 

8.5.1 MIL-STD-1290 (Series): Light Fixed- and Rotary-Wing Aircraft Crash Resistance . 

The third edition (1971) of the Crash Survival Design Guide, TR-71-22 [31], formed the basis 
for the original (1974) version of the U.S. Army-sponsored military standard for “Light Fixed- 
and Rotary-Wing Aircraft Crash Resistance,” Military Standard 1290 [32], 

§5.5 of MIL-STD-1290: Postcrash Fire Protection, established detailed standards for: 

a. Fuel containment 

b. Fuel tank design criteria, including fittings and interconnections for both main and 
extended range tanks 

(1) Fuel lines 

(2) Frangible attachments 

(3) Self-sealing breakaway couplings and valves 
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c. Separation of fuel and ignition sources 

d. Separation of flammable fluids from occupiable areas 

e. Barriers 

§5.5.2 contains detailed design requirements for minimizing susceptibility to postcrash fires from 
all flammable fluids. 

Appendix A, §10, includes test methods for determining qualifications of fuel system 
components. 

Original MIL-STD-1290 (January 25, 1974) was superseded by MIL-STD-1290A on September 
26, 1988, [97] which in turn was cancelled by the Department of Defense in December 1995. 
There is currently no superseding documented standard. Nevertheless, the criteria established by 
MIL-STD-1290A are acknowledged to be the current state-of-the-art of helicopter 
crashworthiness. 

8.5.2 ADS-11 (Series): Survivability Program. Rotary Wing . 

The current version, ADS-11B, was issued in May 1987, superseding ADS-11 A, which was 
issued in April 1976. ADS-1 IB is currently in effect [91]. 

§5.3, Crashworthiness, establishes the criteria for designers to address, as a minimum, structural 
crashworthiness, occupant retention, injurious environment, postcrash fire potential, and 
evacuation. 

§5.3.1 requires that contractors define their design concepts for achieving the levels of 
crashworthiness specified in the System Specification. It expects descriptions of features, 
analyses and estimates for effectiveness of each of the components and subsystems listed in 
Appendix I to the standard. Appropriate crashworthiness tests are specified in Aeronautical 
Design Standard ADS-36: “Rotary Wing Aircraft Crash Resistance.” 

Appendix I to ADS-1 IB sets out specific criteria for evaluating aircraft crash survivability. 
Postcrash fire potential rating areas include: 

a. Spillage control 

(1) Fuel containment 

(2) Oil and hydraulic fluid containment 

(3) Flammable fluid lines 

(4) Firewall 

(5) Fuel flow interruptors 

b. Ignition Control 

(1) Induction and exhaust flame location 

(2) Location of hot metals and shielding 

(3) Engine location and tiedown strength 
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(4) Battery location and tiedown strength 

(5) Electrical wire routing 

(6) Boost pump location and tiedown strength 

(7) Inverter location and tiedown strength 

(8) Generator location and tiedown strength 

(9) Lights location and tiedown strength 

(10) Antenna locations and tiedown strength 

1[10.2.a. is significant in that it specifies a total systems approach to assigning evaluation ratings; 

e.g., “...specific shortcomings in ignition control.. .need not be partially or totally penalized if 
spillage control is substantiated....” 

^[10. 2. b. establishes even more stringent requirements that: “The evaluation will be conducted 
against the optimum crashworthiness criteria stated herein in lieu of RFP and/or System 
Specification requirements which may have been subject to tradeoff.” 

Detailed criteria for determining the Postcrash Fire Potential Ratings for the areas specified 
above are contained in ^10.2. 3 of ADS-1 IB. 

8.5.3 ADS-36: Rotary Wing Aircraft Crash Resistance . 

Aeronautical Design Standard (ADS) 36, Rotary Wing Aircraft Crash Resistance, was issued on 
1 May 1987 and currently remains in effect [98]. 

§5.5 requires that aircraft systems be designed to possess specific postcrash fire protection 
characteristics, specified therein. Major characteristics addressed include: 

a. Fuel containment 

(1) fuel tanks, main 

(2) fuel tanks, extended range 

(3) fuel lines 

(4) frangible attachments 

(5) self-sealing breakaway couplings/valves 

b. Separation of fuel and ignition sources 

c. Separation of flammable fluids and occupiable areas 

d. Shielding 

e. Fuel drains 

f. Fill units and access covers 

g. Fuel pumps 

h. Fuel filters and strainers 

i. Fuel quantity indicators 

j. Vents 

k. Hydraulic and oil systems 

(1) Hydraulic and oil lines and couplings 
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(2) Hydraulic and oil systems components 

(3) Oil coolers 

l. Electrical system 

(1) Wiring 

(2) Batteries and electrical components 

m. Airframe and interior materials 

Appendix A, §10, to ADS-36 sets forth methods for testing systems, subsystems and 
components, including: 

a. Fuel tank crashworthiness 

b. Frangible attachments (static and dynamic testing) 

c. Self-sealing breakaway valves (static and dynamic tests) 

d. Hose assemblies (fuel, oil and hydraulic) 

e. Flammability tests for airframe and interior materials 

f. Full scale whole aircraft and sectional crash tests 

8.5.4 Aircraft Crash Survival Design Guide (TR-89-D-22E) . 

The most recent edition of the U.S. Army’s Crash Survival Design Guide was issued in 1989 and 
contains the most up-to-date guidance for designing crashworthy fuel systems to minimize and 
mitigate the effects of postcrash fires in its Volume V: Aircraft Postcrash Survival [86]. Section 
4 establishes basic design guidelines that will inherently resist flammable fuel spillage and 
ignition during survivable accidents. That objective requires that designs must integrate all 
potentially contributory aircraft systems by considering optimization between operational and 
maintenance functionality and crashworthiness. The Design Guide’s priority goals assume the 
following order: 

a. Prevent spillage; but if some does occur, design to: 

b. Prevent ignition; but if some does get ignited, design to: 

c. Isolate. 

8.5.5 Military Specifications (MIL-SPECs) . 

Numerous military specifications have been developed over the years to address specific 
component requirements within crashworthy fuel systems. As a cost savings measure, many 
were cancelled without supersession by the Department of Defense during the 1990s in its 
attempt to minimize the number of detailed specifications visited upon contractors and to 
transition to performance specifications. Unfortunately, there was little evaluation of the 
significance of these cancelled CRFS specifications for their effect on the suitability, safety, and 
survivability of systems that might be procured absent detailed performance criteria. Although 
there is currently an effort underway to memorialize the knowledge and experience of DOD 
agencies and appropriate civilian standards and practices organizations (e.g., SAE and ASTM), 



designers and procurers of aeronautical systems must guard that the current absence of corporate 
memory does not permit the loss of historical lessons so dearly learned. 

• MIL-T-27422B: Tank, Fuel, Crash-Resistant. Aircraft 

Of the various military specifications relating to CRFS, the most significant is 
undoubtedly MIL-T-27422B [30]. Although published in February 1970 (Amended in 
April 1971), MIL-T-27422B remains the most current specification covering suitable 
design and materials for fabrication and testing of crashworthy fuel tanks. There is 
currently an effort by the SAE G-9 Fuel Tank Bladder Sub-Committee to reach 
consensus on a new fuel tank specification (MIL-PRF-27422) to be published by the U.S. 
Army that essentially reiterates the technical details of MIL-T-27422B in a performance 
specification. 

Other pertinent specifications include: 

• MIL-H-25579E (current version): Hose Assembly, Tetrafluoroethylene, High 
Temperature. Medium Pressure. General Requirements for 

• MIL-V-27393/A: Valve. Safety. Fuel Cell Fitting. Crash Resistant General Specification 
for (Cancelled, superseded by SAE Aerospace Recommended Practice (ARP)-1616A 
dated April 5, 1991.) 

• MIL-H-38360: Hose Assembly. Tetrafluoroethylene. High Temperature. High Pressure. 
Hydraulic and Pneumatic (Cancelled, superseded by SAE AS 604 and AS 1339.) 

• MIL-H-83796: Hose Assembly. Rubber. Lightweight. Medium Pressure. General 

Specification 

8.5,6 MIL-STD-882D. Dated 10 Feb 2000: Standard Practice for System Safety . 

This document defines: “. . . the system safety requirements to perform throughout the life cycle 
for any system, new development, upgrade, modification, resolution of deficiencies, or 
technology development. When properly applied, these requirements should ensure the 
identification and understanding of all known hazards and their associated risks; and mishap risk 
eliminated or reduced to acceptable levels. The objective of system safety is to achieve 
acceptable mishap risk through a systematic approach of hazard analysis, risk assessment, and 
risk management. This document delineates the minimum mandatory requirements for an 
acceptable system safety program for any DOD system.” 

The specific methodologies and applications established by MIL-STD-882D are consistent with 
the intent of 14 CFR §25.1309 and the guidance furnished in AC 23-1309-1C. It would be 
appropriate for the FAA AC guidance to cross-reference to the MIL-STD. 
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9. CONCLUSIONS. 


The following are conclusions reached as a result of this study of Transport Airplane Crash 

Resistant Fuel Systems. 

1. Crash-resistant fuel systems developed and utilized by the U.S. Army to safely contain 
fuel are highly effective in preventing postcrash fires that cause thermal injuries and 
death. 

2. Research conducted to date indicates that the knowledge surrounding severe but 
survivable large transport aircraft accidents and the behavior of the aircraft structures in 
those accidents is not well known or understood, due primarily to the lack of 
crashworthiness data recorded at the accident scene. 

3. Increasing the severity level of the large transport aircraft survivable accident can be 
accomplished by the integration of much of the U.S. Army developed CRFS technology 
already in existence, i.e., rupture-resistant tanks, self-sealing breakaway valves, 
crashworthy hoses and end fittings and protective placement of the various CRFS 
components within the aircraft structure. 

4. CRFS knowledge and technology are not sufficient at this time to allow practical 
improvements in the crash resistance of current integral fuel tanks in transport airplanes. 

5. The integration of CRFS technology into the large transport aircraft fleet can be 
accomplished more efficiently and at a lower cost and at reduced weight when more is 
known about airframe behavior during the more severe accidents. 

6. The greatest practical reduction to the postcrash fire threat could be achieved with the 
development of a fuel that is hard to spill, but if spilled is extremely difficult to ignite 
outside the engine, but if ignited, incorporates self-extinguishing characteristics. The 
feasibility of the development of such a fuel is unknown. 



10. RECOMMENDATIONS. 


The recommendations, based on this study, outline the research efforts which should be 
undertaken by the FAA and NASA to support the development of improved crash-resistant fuel 
systems for large transport category airplanes. 

The following recommendation matrix is divided into three sections: Section I - Level of Crash 
Protection Desired: Section II - Hazard Reduction Methods; and Section HI - Information 
Dissemination. Each of the three sections and their subsections are further divided into three 
time periods: short term, mid term, and long term. 


I. RECOMMENDATIONS FOR LEVEL OF CRASH 
PROTECTION DESIRED 

YEARS | 

Short Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

A. Specify a crash environment severity for which occupant 
survival is deemed economically feasible and practical 
today: 

X 





1 . As more knowledge is gained, continually reevaluate 
and update the severity levels based on what is 
practical. 


X 

X 

X 

X 

B. Elevate the FAA and the NTSB accident investigators’ 
level of expertise in the area of crash survivability, with 
special training related to crash kinematics, structural 
behavior and the behavior of the fuel, oil and electrical 
systems: 

X 

X 

X 



1 . Develop a crash survival investigator training syllabus 
and applicable accident investigation forms. 

X 





2. Conduct training classes and on-the-job training using 
both test and nontest crashed aircraft. 


X 




3 . As more knowledge is gained, continually update the 
syllabus, investigation forms and the investigative 
process. 



X 

X 

X 

C. Using investigators skilled in the field of crash 

survivability, develop crash kinematic data for each 
accident to include impact velocities and stopping distances 
related to the vertical, longitudinal, and lateral directions, as 
well as typical structural deformation and displacement 
patterns related to serious but survivable accidents. 



X 

X 

X 

1 . Develop methods to easily compile, store and retrieve 
crash data for future use. 

X 





2. As more knowledge is gained, continually update the 
data and storage and retrieval methods. 


X 

X 

X 

X 
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I. RECOMMENDATIONS FOR LEVEL OF CRASH 
PROTECTION DESIRED (Continued) 

YEARS 

Short Term 

Mid 

Term 

Long 

Term 

i 

2 

3 

4-10 

11- 

D. Develop fuel system hazard analysis methods: 



X 



1 . Develop and/or revise the Survivability 

Hazard/Postcrash Fire Potential Rating system similar 
to that found in Section 7. 1 of the final report “A Study 
of Transport Airplane Crash Resistant Fuel Systems,” 
Robertson Aviation, L.L.C. Report No. RA-FAA-01- 
131. 



X 



2. Develop and/or revise the Fuel System Fire Hazard 
Level Reduction Rating system similar to that found in 
Section 7.2 of the final report “A Study of Transport 
Airplane Crash Resistant Fuel Systems,” Robertson 
Aviation, L.L.C. Report No. RA-FAA-0 1-131. 



X 



3. As more knowledge is gained, continually update the 
fuel system hazard analysis methods. 




X 

X 

E. Crash test large transport aircraft and/or portions of their 
structure to obtain baseline data: 

X 

X 

X 

X 

X 

1 . Conduct full-scale crash tests under “crash scenario” 
conditions to establish crash loads and displacements 
throughout the airframe and fuel system. 

X 

X 

X 

1 

X 

X 

2. Use data derived from the testing proposed above to 
design aircraft section tests incorporating fuel system 
components under varying impact conditions 
incorporating simultaneous horizontal and vertical 
loading. 


. X 

X 

X 

X 

3 . Incorporate instrumented anthropomorphic dummies 
during testing to ascertain loads transmitted to 
passengers across the fuselage crash load spectra. 

X 

X 

X 

X 

X 

4. As more knowledge is gained, continually update the 
baseline data. 


X 

X 

X 

X 


10-2 

































II. RECOMMENDATIONS FOR HAZARD REDUCTION 
METHODS 

YEARS | 

Short Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

1 . Broaden research into materials which can be used to 
improve integral fuel tank properties for crash 
resistance, fatigue life, ultimate strength, ductility, 
weight, and cost. 


X 

X 

X 


2. Initiate research and development in cooperation with 
tank manufacturers to develop and test improved crash- 
resistant fuel tanks suitable for transport airplanes. 


X 

X 



3. Initiate research and development in cooperation with 
valve manufacturers to develop and test self-sealing 
breakaway valves suitable for transport airplanes. 


X 

X 



4. Develop and test self-sealing breakaway valves for 
fuel, vent and hydraulic line locations where pylon 
and/or engine separation would be expected to occur. 


X 

X 



5. Develop and test crash resistant bladders or similar type 
concepts suitable for transport airplane fuel tanks. 


X 

X 



6. Develop and test frangible fastening methods to include 
bolts, clips, clamps, and other structural techniques 
suitable for use in transport airplanes. 


X 

X 



7. Develop lightweight crash-resistant fuel lines and end 
fittings suitable for use in transport airplanes. 


X 

X 



8. As more knowledge is gained, continually update the 
CRFS component designs and technology. 



X 

X 

X 

B. Conduct aircraft section tests to improve analytical 

techniques for determining whether landing gear and 
engines will separate without damaging wing or center 
fuel tank integrity. 


X 




1 . Conduct similar tests with newly designed aircraft. 




X 

X 



































II. RECOMMENDATIONS FOR HAZARD REDUCTION 
METHODS (Continued) 

YEARS | 

Short Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

C. Conduct crash tests of large transport aircraft and/or 

portions of their structure containing various CRFS 
components and overall CRFS system concepts to 
determine level of protection provided. 




X 

X 

1 . Conduct similar testing with new aircraft and new 
CRFS designs. 



L 

X 

X 

D. Re institute research on the development of a fuel that is 

hard to spill, but if spilled is extremely difficult to 
ignite outside the engine, but if ignited would 
incorporate self-extinguishing characteristics. 

X 

X 

1 

X 

X 

X 


III. RECOMMENDATIONS FOR INFORMATION 
DISSEMINATION 

| YEARS | 

Short Term 

Mid 

Term 

Long 

Term 

1 

2 

3 

4-10 

11- 

A. Develop a method of storing, retrieving and readily 

disseminating to the aerospace community the usable 
knowledge gained during programs I and II. 


X 




B. Prepare design guides, advisory circulars, etc. to 

present useful results of the various research and testing 
programs to: 

Aircraft designers 
FAA rule makers 
FAA certification personnel 
Aerospace community overall 



X 

X 

X 

C. As more knowledge is gained, continually update the 

storage and retrieval system, and the various aids used 
to disseminate the information to the aerospace 
community. 


X 

X 

X 

X 
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APPENDIX A— TECHNICAL DATA SHEET FOR THE SELF-SEALING 
BREAKAWAY VALVE USED IN THE DC-9 AIRLINER AUXILIARY 
FUEL SYSTEM FUEL LINES— ISSUED 1967 
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P/N's— AE93093Z (Coupling Assembly) 

AE93094Z (Coupling Half-Bulkhead) 

AE93095Z (Coupling Half-Hose Attaching) 

Design Specifications 

Media-Fuel 

Pressure— Operating 30 psi 

Proof 60 psi (Coupled) 

60 psi (Uncoupled) 

Min. Burst 90 psi (Coupled) 

90 psi (Uncoupled) 

Temperature— — 65°F to -f-160°F 

Material— Aluminum 

Seals-BUNA-N 

Dimensions— Reference standard drawings 

Testing— Coupling is a modification of the 3750 series 
which is approved to the requirements of Mlt-C- 
74I3A. Pre-production testing is described in TR 
62207D. 


Design Features 


1. Lightweight because of all aluminum construction. 

2. Internal valve design provides smooth flow pat- 
tern and is identical to that used in Aeroquip 
stondard 3750 series couplings. 

3. The connecting union nut is mounted on the hose 
attaching half by incorporating three (3) shear 
pins which are designed to break away at 220 
to 275 lbs. pull. When rated pull is achieved, 
coupling halves separate. Valve action shuts off 
fluid flow preventing excessive fluid spillage. 

4. Coupling may be used with other fluid applica- 
tions with appropriate seal changes. 


Application History 


Developed for manufacturer's use on fuel system of a 
commercial aircraft. Coupling designed to separate 
upon impact at an established force to effect shut-off 
of fuel flow in inaccessible area. 


Copyright 1967 by Aeroquip Corporation 
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PLANTS: Jackson, Michigan 
Dallas, Texas / Burbank, California 


AEROQU1P CORPORATION / JACKSON, MICHIGAN _ 

I AEROOUIP (CANADA) LTD.. Toronto 19. Ontario 

AIRCRAFT DIVISION | AEROOUIP G.m.b.H.. Baden Baden, Germany 

Specifications subject to change svithout notice f Arroquip Products ore protected by patents internationally 


2A 2M 1-67 


L itho in U. S. A . 
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APPENDIX B— UNISSUED ROUGH DRAFT OF THE FAA PREPARED NPRM 89-1 1 A 



[4910-13] 


DRAFT 11/7/95 


DEPARTMENT OF TRANSPORTATION 
Federal Aviation Administration 
14 CFR Part 25 

[Docket No. 25890; Notice No. 89-11 A] 

RIN 2120-AC87 

Fuel System Crash Resistance 

AGENCY: Federal Aviation Administration, DOT. 

ACTION: Notice of proposed rulemaking. 

SUMMARY: This notice proposes an amendment to the airworthiness standards for 

transport category airplanes to require improved airplane fuel system crash resistance. 
The current standards would be amended to require minimization of drat fuel spillage as 
the result of following an accident, be minimiz e d ; Methods that would be required to 
reduce fuel spillage include: (1) a means to shut off the airplane fuel supply to each 
engine during both the normal and emergency shutdown sequence; (2) location of 
fuselage- mounted fuel tanks in protected positions so that exposure to penetration or 
damage due to fuselage deformation, fuselage separation, or displaced structural members 
is unlikely; (3) a means to shut off the fuel supply to fuel lines routed outside the fuel 
tank walls during the takeoff and landing phases of flight, or installation of self-sealing 
fittings in locations where damage is likely during fuselage or engine separation; and (4) 
improved impact resistance and elongation requirements for essential fuel lines routed 
outside the fuel tank walls and located within or adjacent to the fuselage. This proposal is 
in response to the Aviation Safety Research Act of 1988 and is intended to minimize the 
potential for post-crash fire and to provide additional passenger evacuation time 
following impact survivable accidents. The proposed amendments would apply to 
manufacturers of newly designed transport category airplanes. 
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DATES: Comments must be received on or before [insert date 120 days after date of 
publication] 

ADDRESSES: Comments on this proposal may be mailed in duplicate to: Federal 
Aviation Administration, Office of the Chief Counsel, Attention: Rules Docket 

(AGC-10), Docket No. 25890, 800 Independence Avenue SW., Washington, DC 20591, 
or delivered in duplicate to: Room 91 5G, 800 Independence Avenue SW., Washington, 
DC. Comments must be marked: Docket No. 25890. Comments may be inspected in 
Room 91 5G weekdays, except Federal holidays, between 8:30 a.m. and 5:00 p.m. In 
addition, the FAA is maintaining an information docket of comments in the Office of the 
Assistant Chief Counsel (ANM-7), Federal Aviation Administration, Northwest 
Mountain Region, 1601 Lind Avenue SW., Renton, Washington 98055-4056. Comments 
in the information docket may be inspected in the Office of the Assistant Chief Counsel 
weekdays, except Federal holidays, between 7:30 a.m. and 4:00 p.m. 

FOR FURTHER INFORMATION CONTACT: Michael E. Dostert, FAA, Airframe 
and Propulsion Branch (ANM-112), Transport Airplane Directorate, Aircraft 
Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-4056; 
telephone (206) 227-2132; facsimile (206) 227-1320. 

SUPPLEMENTARY INFORMATION: 

Comments Invited 

Interested persons are invited to participate in this proposed rulemaking by 
submitting such written data, views, or arguments as they may desire. Comments relating 
to any environmental, energy, or economic impact that might result from adopting the 
proposals contained in this notice are invited. Substantive comments should be 
accompanied by cost estimates. Commenters should identify the regulatory docket or 
notice number and submit comments in duplicate to the Rules Docket address specified 
above. All comments received on or before the closing date for comments will be 
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considered by the Administrator before taking action on this proposed rulemaking. The 
proposals contained in this notice may be changed in light of comments received. All 
comments will be available in the Rules Docket, both before and after the closing date for 
comments, for examination by interested persons. A report summarizing each 
substantive public contact with FAA personnel concerning this rulemaking will be filed 
in the docket. Commenters wishing the FAA to acknowledge receipt of their comments 
must submit with those comments a self-addressed, stamped postcard on which the 
following statement is made: "Comments to Docket No. 25890." The postcard will be 
date stamped and returned to the commenter. 

Availability of NPRM 

Any person may obtain a copy of this notice by submitting a request to the Federal 
Aviation Administration, Office of Public Affairs, Attention: Public Information Center, 
APA-230, 800 Independence Avenue SW, Washington, DC 20591, or by calling (202) 
267-3484. Communications must identify the notice number of this NPRM. Persons 
interested in being placed on a mailing list for future rulemaking documents should also 
request a copy of Advisory Circular No. 11-2A, Notice of Proposed Rulemaking 
Distribution System, which describes the application procedure. 

Background 

Improving airplane fuel system crash resistance has long been a subject of 
proposed FAA regulatory action. In 1964, the FAA considered adopting standards for 
crash-resistant fuel tanks, self-sealing breakaway fuel line fittings, and engine ignition 
suppression systems for transport category airplanes. It was found, however, that 
insufficient technical information existed at that time to provide a basis for developing 
regulatory standards. Subsequently, the FAA considered other means to mitigate the 
post-crash fire and explosion hazard, such as fuel tank inerting and suppression systems. 
In response to a recommendation from the National Transportation Safety Board (NTSB) 
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in 1971 and a subsequent petition for rulemaking from the Aviation Consumer Action 
Project (ACAP) in 1972, the FAA issued Notice 74-16 (39 FR 12260, April 4, 1974) 
proposing to require the installation of means to prevent fuel system explosion. As a 
result of the comments made in response to Notice 74-16, the FAA determined that such 
means would have little or no effect in reducing post-crash fire and explosion hazards 
when fuel is spilled from damaged tanks. It was also concluded in a 1977 public hearing 
that crash-resistant, wing-mounted fuel tanks would not be effective in view of the wing 
damage and separations that had occurred in several impact-survivable accidents. The 
conclusions reached at these hearings have been supported by subsequent studies and 
research projects conducted by the FAA and industry. As a result of the information 
gained from the public hearing, the FAA withdrew Notice 74-16 in 1978 and established 
the Special Aviation Fire and Explosion Reduction (SAFER) Advisory Committee to 
evaluate possible means to improve survivability in the post-crash event. 

The SAFER Committee consisted of a chairman, executive director, and 24 
representatives spanning the spectrum of international aviation interests. The committee 
reviewed worldwide transport airplane accidents involving post-crash fuel fires and fuel 
tank explosions that had occurred between 1964 to 1978 and concluded that with existing 
technology, the potential for post-crash fires and explosions could be reduced. (The 
SAFER Committee’s advice and recommendations to the FAA are embodied in a final 
report, FAA-ASF-80-4, "Final Report of the Special Aviation Fire and Explosion 
Reduction (SAFER) Advisory Committee," dated June 26, 1980, a copy of which is 
contained in the docket for this rulemaking.) 

On the basis of available accident data, the SAFER Committee recommended two 
propulsion system related actions to amend 14 CFR part 25 of the Federal Aviation 
Regulations (FAR). The first recommendation concerned a design practice in use on 
some current airplanes that provides for flame arrestors in the fuel tank vent lines to 
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reduce the likelihood of fuel tank explosion caused by flame propagation into the tank 
through the fuel tank vent. The second recommendation required closure of both fuel 
tank-to-engine and engine fuel control shutoff valves during normal engine shutdown. 
The Committee considered that this latter design practice would maximize the probability 
of engine fuel supply shutoff in post-crash fire accidents. 

The Committee C ommit ee also reviewed fuselage fuel system designs and 
determined that certain industry design practices, including providing for displacement of 
the tank without leakage, the use of flexible stretchable fuel lines, locating fuel tanks 
outside areas where penetration from displaced structural members was likely, and 
providing considerable clearance between the tank and surrounding structure to minimize 
tank damage, provided safe auxiliary fuel tank installations. 

To implement the SAFER propulsion system recommendations, preliminary 
rulemaking action was initiated. Advance Notice of Proposed Rulemaking (ANPRM) 
No. 84-17 was published in the Federal Register on September 26, 1984 (49 FR 38078), 
for the purpose of obtaining public comments, information, and data relative to adding 
new airworthiness standards applicable to transport category airplane fuel systems. The 
objective of the rulemaking proposed in Notice 84-17 was to develop airworthiness 
standards that would provide protection against fuel tank explosions following a post- 
crash ground fire, and that would assure engine and auxiliary power unit fuel supply 
shutoff to reduce the fire hazard from spilled fuel. 

While the rulemaking for Notice 84-17 progressed. Congress enacted Public Law 
100-591, "Aviation Safety Research Act of 1988." Section 9 (a) of that Act required the 
Administrator of the FAA to issue an ANPRM to determine the feasibility of installing, in 
all air carrier airplanes, crashworthy fuselage fuel tanks and fuselage fuel lines that are 
rupture resistant and that disconnect and seal in the event of an accident. Notice 89-11 
was published in response to that action. 
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Notice 89-11 contained seventeen questions intended to obtain information 
regarding the economic and technological feasibility, costs (weight/range 
reduction/hardware, design, maintenance), safety benefits, scope, applicability, and 
alternatives of a regulatory change requiring the installation of crashworthy fuselage fuel 
tanks and fuel lines that are rupture resistant and that disconnect and seal in the event of 
an accident. 

Discussion of Comments 

Twenty-four commenters responded to the seventeen questions contained in 
Notice 89-11. Commenters i ncluded the general public, airplane and component 
manufacturers, and other interested organizations in the United States and Europe. All 
commenters agreed with the desired goal of reducing post-crash fuel leakage; however, 
comments and information provided in response to many of the questions posed in the 
notice indicated that more effective fuel leak minimization can be achieved by modifying 
the methods discussed within the notice, t hat th e FAA - should modify th e ori g inal 
propo s al: 

Crashworthy Auxiliary Fuel Tanks 

In regard to the merits of p r opo s al - to requiring© auxiliary fuel tanks located in the 

fuselage to be crashworthy, commenters opposing the concept proposal argue that the 
added cost and complexity of designing fuselage fuel tanks that are more impact resistant 
is not justified based on a review of impact survivable accidents. Several commenters, 
including the European Joint Aviation Authorities (JAA), question the relative benefits of 
changing the current fuselage fuel tank crash resistance requirements. A JAA review of 
United Kingdom historical data for a twelve-year period indicates that although fuel-fed 
post impact fires occurred in a significant percentage of the cases, there were no cases 
that led to recommendations that fuselage fuel tank crashworthiness be improved. The 
JAA also states that fuselage fuel tanks located within the wing center section are 
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normally contained within a strong structural framework and appear to be effectively 
protected. 

The FAA agrees with the JAA findings, which are supported by information 
contained within FAA Report No. DOT/FAA/CT-87/18 "Fuel Containment Concepts- 
Transport Category Airplanes," dated November 1987; and FAA report "Evaluation of 
Expected Effectivity of Antimisting Fuel in Post Crash Fire Accidents,” 1964-1983. 
(Copies of these documents are available in the docket.) Information within these 
documents indicates that integral fuel tanks located in the wing outboard of the fuselage 
and fuel lines located within the fuselage are the main sources of leakage during impact 
survivable accidents. Fuselage fuel tanks, including those located within the wing center 
section, were not identified to have been the primary source of leakage in any of the 70 
impact survivable accidents reviewed. 

Two other commenters stated that existing industry design practices and FAA 
policy provided in Advisory Circular 25-8, "Auxiliary Fuel System Installations," dated 
May 5, 1986, have provided for auxiliary fuel tank installations that have been effective at 
reducing the post-crash fuel fire hazard from fuselage fuel tanks. The FAA agrees that 
certain design practices utilized by some manufacturers, such as the use of self-sealing 
fittings, the use of flexible stretchable fuel lines, and locating fuel tanks where damage 
from displaced landing gear or structural members is unlikely, do improve the crash 
resistance of fuselage-mounted auxiliary fuel tank installations. However, these 
practices are not currently mandated by the regulations and are not utilized by all 
manufacturers of transport category airplanes. 

Currently mandated practices include $ 25.721 (a)(1). which requires that the landing 
gear and fuel system be designed such that if the landing gear fails due to overloads (in 
the upward and aft directions! during takeoff and landing, the failure is not likely to cause 
"spillage of enough fuel from any fuel system in the fuselage to constitute a fire hazard.'* 
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In addition. $ 25.963 (d~) requires that fuselage fuel tanks resist rupture and retain fuel 
under the emergency landing conditions defined in $ 25.561 and be "in a protected 
position so that exposure of the tanks to scraping action with the ground is unlikely." 
These sections do not address the SAFER recommendations noted above that include 
providing for displacement of the tank without leakage, the use of flexible stretchable fuel 
lines, locating fuel tanks outside areas where penetration from displaced structural 
members is likely, and providing considerable clearance between the tank and 
surrounding structure to minimize tank damage. T he FAA therefore considers that 
amendment of the regulations is needed to ensure that all new designs meet minimum 
crashworthiness standards. 

Fuel Tank Crash Loads 

Notice 89-1 1 also requested specific information regarding what standard should 
be used for establishing crash resistance of fuselage fuel tanks. Commenters generally 
agreed that Military Specification MIL-T-27422B, 'Tank, Crash R^esistant, Aircraft," 
dated February 24, 1970, including Amendment 1, dated April 13, 1971, "Type II, non- 
self-sealing, Class A flexible cell construction," is a good starting point for the 
development of impact resistance criteria for transport category airplanes. However, this 
specification was developed for rotorcraft and small airplane fuel tanks that are exposed 
to distinctly different crash dynamics than transport category airplane fuel tanks. These 
commenters therefore recommended further study regarding the crash dynamics of large 
fuel tanks located in these types of airplanes. 

Although the SAFER report indicated that crashworthy fuel tanks were not 
considered effective with respect to the wing fuel tanks of transport category airplanes, 
the FAA is conducting a research and development program with auxiliary fuselage- 
mounted fuel tanks to evaluate possible fuel containment design criteria and to determine 
whether new or revised structural design standards are necessary. To date, test results 
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show that fuselage-mounted fuel tanks that are installed utilizing the guidelines provided 
in Advisory Circular 25-8, "Auxiliary Fuel Systems Installations,” resist rupture during 
typical impact survivable crash load conditions. 

Since issuance of Notice 89-11, the FAA has requested assistance from the 
Aviation Regulation Advisory Committee (ARAC) to assist in determining what standard 
should be used for the dynamic load requirements for airplane fuel tanks. The 
committee commit e e is currently attempting to harmonize the FAR and Joint 
Airworthiness Requirements (JAR) and is developing a recommendation that, if accepted 
by the FAA, will be the subject of future rulemaking. Therefore, amendment of the fuel 
tank load requirements is not addressed in this notice. 

Self Sealing Fittings— 

Comments were also received regarding the merits of requiring the installation of 
self-sealing fittings in fuselage fuel lines and the engine fuel feed lines. One comraenter 
stated that self-sealing fittings are currently in use in a number of fuselage-mounted 
auxiliary fuel tanks in McDonnell Douglas Model DC-9 and Model MD-80 airplanes and 
have provided satisfactory service experience. The commenter further stated that other 
methods of providing fuel system crashworthiness have been employed by other 
manufacturers and that mandating self-sealing fittings may unnecessarily inhibit airplane 
fuel system design. This commenter and four other commenters opposed or questioned 
installation of self-sealing fittings in the engine fuel lines due to possible inadvertent 
closure of the valves and unwanted loss of engine power. These commenters indicate 
that inadvertent closure of self-sealing fittings could result in a significant increase in 
non-restartable engine incidents and could result in loss of power from more than one 
engine. They further expressed a concern that requiring self-sealing fittings could result 
in an overall reduced level of safety. However, these commenters did not provide factual 
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data to substantiate that new technology self-sealing fittings would be exposed to high 
rates of inadvertent closure and therefore cause a significant reduction in airplane safety. 

Other commenters referenced the satisfactory service experience of self-sealing 
fittings in military airplanes and fully supported the proposal to require installation of 
these fittings in fuel lines routed within or adjacent to the fuselage and at the engine to 
airframe connection point Information provided by one conunenter indicates that newer 
technology self-sealing fittings provide significantly improved reliability and are designed 
to preclude unwanted closure and will operate with a mean time between failure of 
30,000 hours. Another commenter stated that self-sealing fittings have been in use for 
many years on military aircraft and reliability data is available from this source. This 
commenter also commented on the potential benefits of correctly installing practical 
crashworthy fuel systems. The commenter stated that "...since 1970 the U.S. Army has 
experienced approximately 3200 crashes of aircraft equipped with crashworthy fuel 
systems. As of the date of the comment, October 1989, only two individuals had died by 
fire in accidents which were otherwise survivable." 

Flexible Stretchable Fuel Lines 

Another fuel containment concept proposed in Notice 89-1 1 for which cost and 
benefit information was requested concerned a proposal to mandate the use of stretchable 
flexible fuel lines for all fuel lines routed within the fuselage contour. No specific 
comments regarding this proposal were received. 

Discussion 

Based on the comments received in response to Notice 89-1 1, the FAA proposes 
to amend the fuel system requirements of part 25 to minimize the potential for fuel 
spillage within or adjacent to the passenger compartment from fuel sources where it can 
be shown to be economically feasible, utilizing currently available technology. The FAA 
has determined that these sources include auxiliary fuel tanks located within the fuselage 
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contour and fuel lines routed outside the fuel tanks within or immediately adjacent to the 
passenger cabin. Examples of such fuel line routings include fuel lines routed above or 
below the passenger cabin floor, and fuel lines routed along the external fuselage skin 
within failings. Fuel lines that are addressed include those lines that feed fuel to both 
essential systems, such as the engines and essential Auxiliary Power Units (APtTs), and 
those that feed non essential systems, such as airplane center of gravity trim fuel tanks, 
and non essential APU’s. 

This notice of proposed rulemaking contains four proposals. The first, to add a 
new paragraph (i) to § 25.1189, would implement the SAFER committee 
recommendation to require closure of the airframe mounted engine fuel shutoff valve 
when either the normal or emergency engine shutdown procedure is carried out by the 
flightcrew. Currently, manufacturers of most transport category airplanes activate the 
airplane mounted fuel shutoff valve via the normal fuel shutoff levers. Therefore, this 
proposal is not expected to have a significant cost impact. As discussed earlier in this 
notice, the fuel feed shutoff provisions were originally proposed in Notice 84-17. No 
adverse comments were received to that proposal in response to Notice 84-17. Those 
provisions have now been incorporated in this rulemaking, which the FAA anticipates 
will more completely address the threat from fuel leakage following a survivable crash 
landing. 

The second proposal would amend § 25.963(d) to add a requirement to locate fuel 
tanks that are within the fuselage contour r e quir e- fu e l tanks locat e d within th e fus e lag e 
contour to b e in a protect e d - Toeation so that exposure to penetration or damage due to 
fuselage deformation, fuselage separation, or displaced structural members (including the 
landing gear) , - and s c ra ping action with th e ground is unlikely. The intended compliance 
methods for these additional requirements would include analysis of the fuselage 
auxiliary fuel tank installation under impact survivable crash conditions that exceeded the 
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loads defined in 5 25.561 (b) to show that the fuel tankage is not located where fuselage 
separation or damage from displaced structural members is likely to occur. In addition, 
an analysis would be required to show that damage to auxiliary fuel tanks did not occur 
due to fuselage deformation or crushing that would occur during the loading conditions 
defined in S 25.56 1(b). This proposal is consistent with guidance provided in FAA 
Advisory Circular (AO 25-8. Auxiliary Fuel System Installations, for determining the 
degree of fuselage deformation or structural crush distance that should be available to 
avoid auxiliary fuel tank ground contact. 

This proposal would apply to fuel tanks and portions of fuel tanks l ocated within 

the fuselage contour, such as those tanks located within the wing center section, vertical 
and horizontal stabilizer, and cargo compartment, and would mandate practices currently 
in use by most manufacturers for installation of auxiliary fuel tanks. 

The third proposal would amend § 25.993 to add a new paragraph (g) to require 
that fu e l - sourc es- for fuel lines routed outside the fuel tank walls to be shut of f from the 
fuel supply dining the takeoff and landing portions of flight, or to have automatic fuel 
shutoff capability during fuselage or engine separation. The use of self-sealing fittings 
would be one option available to the applicant to satisfy the proposed fuel shutoff 
requirement. Commenters should address the weight, cost, and safety benefits, including 
the effects on unwanted, non-restartable engine shutdown rates, of installing new 
technology self-sealing fittings . 

The fourth proposal would revise § 25.993(f) to require that fuel lines routed 
outside the fuel tank walls, and within or adjacent to the fuselage, be designed and 
installed to resist rupture when the line is stretched and deformed by adjacent structure 
during fuselage separation. Fuel lines currently available and utilized by some 
manufacturers have demonstrated impact resistance during guillotine tests, with the line 
at critical operating presures and temperatures, that resulted in elongation of up to 30 
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percent of their original length without leakage. This level of impact resistance and 
elongation capability is considered by the FAA to meet the intent of this proposal. 
Specific methods of compliance with this requirement would w ould be de scribedfi ned in 
a new advisory circular developed for that purpose. 

The proposal to amend § 25.993(f) to require minimum elongation and 
deformation requirements for fuselage fuel lines is based on service experience. 
Currently, § 25.993(f) requires "each fuel line within the fuselage to be designed and 
installed to allow a reasonable degree of deformation and stretching without leakage." 
Compliance with this rule does not require consideration of the degree of deformation 
and stretching that has occurred during separation of the fuselage and does not apply to 
fuel lines routed outside the fuselage adjacent to the passenger compartment (such as fuel 
lines routed through fairings). A review of the accident statistics developed by the 
National Transportation Safety Board, and contained within the SAFER report, for the 
period from 1969 to 1978 indicates that 14 out of 27 survivable transport airplane 
accidents resulted in major fuselage structural damage in which the airframe separated 
into three or more sections. In many of these accidents, the fuselage sections remained 
within close proximity to one another such that flexible fuel lines would reduce the 
likelihood of fuel leakage. 

One accident in which damage to the fuel lines routed within the fuselage was 

considered to have contributed to the severity of the accident occurrede ccur e d in 
November 1966 in Salt Lake City and involved a Boeing 727 airplane. In this accident, 
fuselage separation resulted in severing of the three main engine aluminum fuel lines and 
shrouds that were routed from the wing fuel tanks through the fuselage to the aft engine 
locations. Fuel from the failed lines, which was pumped into the fuselage area, was 
determined to be a contributing factor in the severity of the accident. The aircraft 
manufacturer incorporated new technology fuel lines into Model 727 airplanes 
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manufactured after 1966, and made retrofit of the lines available by service bulletin. 
Those fuel lines exhibit greatly improved elongation characteristics and have been shown 
by service experience to reduce fuel spillage. A review of available service history 
information from accidents where fuselage separation occurred on airplanes equipped 
with the new technology lines indicates greatly improved deformation and stretching 
capability is provided by the new lines. 

One accident that clearly demonstrates the benefits of the new technology fuel 
lines occurred in 1975 at Stapleton International Airport in Denver, Colorado, ^here a 
Boeing 727 airplane equipped with the new fuel lines impacted the ground due to 
windshear. The NTSB accident report, NTSB-AAR-76-14, indicates that the fuselage 
separated into three pieces, resulting in elongation of the three main engine fuel lines. 
Due to damage to the engine controls and loss of electrical power, the engines could not 
be shut down and remained operating at a high power, governed only by the reduced fuel 
flow to the engine caused by elongation of the fuel lines. Shutdown of the engines could 
only be achieved when ground crews sprayed fire extinguishing foam into the engine 
inlets. No fatalities due to fuel fire resulted from this accident. 

Notice 89-1 1 contained a four-part question requesting comments regarding what 
airplanes should be affected by a proposed regulatory standard requiring impact-resistant 
auxiliary fuselage fuel tanks and self-sealing fittings. Commenters indicated that the 
applicability of any new standard should be based on a cost benefit evaluation. All 
commenters agreed that the new standards should apply only to new airplanes for which 
the application for original type certification is made after the effective date of the 
amendment. Commenters generally did not support amendment of parts 121 and 135 to 
require all airplanes operated or manufactured after a specified date to meet the new 
standards, regardless of the date of application for type certification. The FAA agrees and 
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proposes that the new standards apply only to newly designed transport category 
airplanes. 

Regulatory Evaluation 
(To be provided by APO) 

Federalism Implications 

The regulations proposed herein would not have substantial direct effects on the 
States, on the relationship between the national government and the States, or on the 
distribution of power and responsibilities among the various levels of government. 
Therefore, in accordance with Executive Order 12612, it is determined that this proposal 
would not have sufficient federalism implications to warrant the preparation of a 
Federalism Assessment. 

Paperwork Reduction Act 

In accordance with the Paperwork Reduction Act of 1990 (44 U.S.C. 3501 et 

sea.), there are no reporting or recordkeeping requirements associated with this final rule. 

Conclusion 

Because the installation of fuel systems with improved crash resistance is not 
expected to result in a substantial economic cost, the FAA has determined that this 
proposed regulation is not significant under Executive Order 12866. However, the FAA 
considers this action to be significant as defined in Department of Transportation 
Regulatory Policies and Procedures (44 FR 11034, February 26, 1979), as it involves a 
matter on which there has been significant public interest. In addition, it has been 
determined under the criteria of the Regulatory Flexibility Act that this regulation, at 
promulgation, would not have a significant economic impact, positive or negative, on a 
substantial number of small entities, since none would be affected. A copy of the initial 
regulatory evaluation prepared for this proposal may be examined in the public docket or 
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obtained from the person identified under the caption, "FOR FURTHER 
INFORMATION CONTACT." 

List of Subjects in 14 CFR part 25 

Aircraft, Aviation safety, F e d e ral - Aviation Administration, Reporting and record- 
keeping requirements. 

The Proposed Amendment 

Accordingly, the Federal Aviation Administration proposes to amend 14 CFR part 
25 of the Federal Aviation Regulations (FAR) as follows: 

PART 25 - AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY 

AIRPLANES. 

1 . The authority citation for part 25 continues to read as follows: 

Authority: 49 U.S.C. app. 1314, 1351(a), 1355, 1421, 1123, 142^ 1425, 1428, 1429^ 
14 - 30; 4 9 U.S.C. 106(gl : and 49 CFR 1.4 - 7fab . 401 13. 44701. 44702. 44704. 

2. Section 25.963 would be amended by revising paragraph (d) to read as follows: 

§ 25.963 Fuel tanks: General 
***** 

(d) Fuel tanks within the fuselage contour must be able to resist leakage and to 
retain fuel, under the inertia forces prescribed for the emergency landing conditions of 
§25.561. In addition, these tanks must be located in a protected position so that 
exposure to penetration or damage due to fuselage deformation, fuselage separation, 
displaced structural members (including the landing gear), and scraping action with the 
ground is unlikely. 

3. Section 25.993 would be amended by revising paragraph (0 and by adding a new 
paragraph (g) to read as follows: 

§ 25.993 Fuel system lines and fittings. 

***** 
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(f) Each fuel line routed outside the fuel tank walls, and within or adjacent to the 
fuselage, must be designed and installed to resist leakage when the line is stretched and 
deformed by adjacent structure during fuselage separation. This capability must be 
shown with the fuel line at the environmental and operating conditions determined to be 
critical. 

(g) Each fuel line that is routed outside the fuel tank walls must provide a means 
to either, 

(1) shut off the supply of fuel during takeoff and landing, or 

(2) have an automatic means to shut off the fuel supply during fuselage or engine 

separation. 

* * * * * 

4. Section 25.1189 would be amended by adding a new paragraph (i) to read as 
follows: 

§ 25.1 189 Shutoff means 
***** 

(i) The airframe-mounted engine and auxiliary power unit (APU) fuel shutoff 
valves must isolate the airplane fuel supply from the engine and APU during both the 
normal and emergency shutdown sequence. 

Issued in Washington, D.C. on 


f:\home\mdostert\arac\nprms\fuel54.doc 

10/2 1/93 '.revised by ps/ns/mdl0/27/93:ps/mdl/19/94:copy sent via cc:mail to APO 

(Won) for review, at request of Ward Keech 

3/1 7/94 rrevised per MED 

10/21/94:revised per Doug's comments 

7/28/95 :ps:editorial review . 

8/2/95 :ps:editorial changes accepted 
9/27/95: revised per Doug's comments 
1 1/7/95 :editorial review of previous version 
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FUEL SYSTEM DESIGN CHECKLIST 


The following fuel system design checklist is Section 6.9 of Chapter 6, Volume I of the 
U.S. Army Aircraft Crash Survival Design Guide, USAAVSCOM TR 89-0-22A, Dec 
1989. 

6.9 DESIGN CHECKLISTS 

6.9.1 Fuel System Design Checklist 

6.9.1 .1 Fuel Tanks 


1. Are the fuel tanks located as far as possible from anticipated impact 
areas, occupiable areas, large weight masses, and primary ignition 
sources? 

2. Are the fuel tanks located as high up in the structure as possible? 

3. Are the fuel tanks located where there is not danger of puncture by a 
collapsing landing gear? 

4. Are the fuel tanks located so that transmissions, engines, and similar 
massive components will not crush the tanks during a crash? 

5. Are the fuel tanks relatively safe from penetrative damage by structural 
stringers and stiffeners? 

6. Can each fuel tank displace in the airframe structure without tearing or 
inducing leaks around the filler area, the fuel line entry and exit, the 
quantity indicator, and the tank-to-structure attachment points? 

7. Do the fuel tanks have smooth, regular shapes, with the sump gradually 
contoured into the tank bottom? 

8. Do all fuel tank concave corners have a minimum radius of 3 in., and all 
convex corners a minimum radius of 1 in.? 

9. Do all fuel tanks meet or exceed the requirements of MIL-T-27422B? 

10. Do all fuel tank fittings meet or exceed the tank pullout strength specified 
in MIL-T-27422B? 
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6. 9.1. 2 Fuel Lines 


11. Are all fuel lines made from flexible hose with a steel-braided outer 

sheath? 

12. Do all hose assemblies meet the strength requirements listed in Table 17, 
Section 6.2.3.1 of the Crash Survival Design Guide (last page of this 
checklist)? 

13. Can all hoses elongate 20% without the hose assemblies spilling fuel? 

1 4. Do fuel lines exit the fuel tank in one protected location? 

1 5. Has the number of fuel lines in the engine compartment been kept to a 
minimum? 

16. Are fuel lines routed along heavier structural members wherever 
possible? 

1 7. Is as much of the fuel line as possible routed through the fuel tanks? 

18. Are fuel lines routed as far as possible from occupiable areas and 
electrical compartments? 

1 9. Are fuel lines routed as far as possible from all electrical equipment and 
wires? 

20. Are fuel lines routed away from areas where large structural damage is 
likely during a crash? 

21 . Are fuel lines routed away from the exhaust system and high-temperature 
heating ducts? 

22. Are the fuel system lines designed with as few fittings as possible? 

23. Are the fuel system lines designed so that uncut hoses are run through 
bulkheads rather than attached to the bulkheads with fittings? 

24. Are self-sealing breakaway valves used wherever a fuel line goes through 
a firewall or bulkhead or is attached to the bulkhead? 

25. Are lines entering and exiting in-line boost pumps made of flexible hose 
that is approximately 20% longer than necessary? 

26. If fuel lines are not longer than necessary for in-line boost pumps, are 
self-sealing breakaway valves used in the lines near the boost pump? 
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27. Are self-sealing breakaway valves used at all points in the fuel lines where 
aircraft structural deformation could lead to line failure? 

28. Are fuel line supports frangible to ensure release of the line from the 
structure during crash impact? 

29. Will the frangible supports meet all operational and service loads of the 
aircraft? 

30. Are all continuous lines running through bulkheads stabilized by frangible 
panels? 

6. 9.1.3 Frangible Attachments 

31 . Are frangible attachments used at all attachment points between the fuel 
tanks and aircraft structure? 

32. Do the specified frangible tank attachment separation loads exceed all 
operational and service loads by a satisfactory margin? 

33. Are the specified frangible attachment separation loads between 25% 
and 50% of the loads required to fail the attached system or 
components? 

34. Will the frangible attachments separate whenever the required loads are 
applied in all possible modes likely to occur during crash impacts? 

6.9. 1.4 Self- Sealing Breakaway Valves 

35. Are breakaway valves installed in all fuel-tank-to-fuel-line connections, 
tank-to-tank interconnects, and at other points in the fuel system where 
aircraft structural deformation could lead to system failure? 

36. Are the shapes of the breakaway valves remaining in the fuel tank 
basically smooth? 

37. Are the breakaway valves recessed into the tank wall so that the tank half 
does not protrude outside the tank wall more than Vz inch after valve 
separation? 

38. Do the specified breakaway valve separation loads exceed all operational 
and service loads of the aircraft? 

39. Are the specified breakaway valve separation loads between 25% and 
50% of the loads required to fail the attached components or lines? 


3 


C-4 


40. Are the breakaway valves required to separate whenever the required 
loads are applied in the modes most likely to occur during crash 
impacts? 

6.9. 1.5 Fuel Drains 

41. Are all fuel line drain valves stabilized where necessary with frangible 
attachments? 

42. Are all structural attachments of fuel tank drains made with frangible 
attachments? 

43. Are all fuel tank drains recessed into the tank so that no part of the drain 
protrudes outside the tank wall? 

6.9.1 .6 Filler Units 

44. Are filler units attached to the aircraft structure with frangible 
attachments? 

45. Are filler caps recessed into the fuel tank wall? 

46. Are long filler necks avoided? 

47. If filler necks are used, are they made from frangible materials and 
designed so that the filler cap stays with the tank after filler neck 
separation? 

6.9. 1.7 Boost Pumps 

48. Can an engine-mounted, engine-driven boost pump be used in the 

aircraft? 

49. If an engine-mounted suction system cannot be used, can an air-driven 
boost pump be used? 

50. Do in-line boost pumps have a structural attachment capable of 
withstanding a 30-G load applied in any direction? 

51. Are tank-mounted boost pumps fastened to the structure with frangible 
attachments? 
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6.9.1.8 


Fuel Filters and Strainers 


52. Are fuel filters and strainers mounted outside the engine compartment 
wherever possible? 

53. Do all strainers and filters have a structural attachment capable of 
withstanding a 30-G load applied in any direction? 

54. Do all strainers and filters retain as small a quantity of fuel as possible? 

6.9. 1.9 Fuel Valves 

55. Has the number of fuel valves been kept to the minimum required for 
operation? 

56. Are self-sealing breakaway valves used at all valve-to-fuel-line 
connections where crash-induced line failure is likely? 

57. Are all small in-line valves fastened to the structure with frangible 
attachments? 

58. Do large valves have a structural attachment capable of withstanding 30- 
G loads in any direction? 

59. Are fuel shut-off valves located outside the engine compartment, either 
on the outside face of the firewall or at the fuel tank outlets? 

6.9.1.10 Fuel Quantity Indicators 

60. Can float-type quantity indicators be used in this fuel system? 

61 . If probe-type indicators are used, are they fabricated from material that 
either is frangible or possesses as low a flexural rigidity as possible? 

62. Is a slightly rounded shoe incorporated at the probe bottom end of all 
probe-type indicators, or is the probe mounted at an angle toward the 
rear of the aircraft? 

63. Are frangible attachments used where it is necessary to stabilize the 
indicator by fastening it to the structure? 

6.9.1.11 Vent Systems 

64. Are high-strength fittings used between the metal insert in the tank and 
the vent line? 
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65. If vent outlets must be supported, are they supported by frangible 
attachments to the structure? 

66. Is the vent line made of wire-covered flexible hose? 

67. Is the vent line routed so that it cannot be snagged in displacing structure 
during a crash? 

68. Is a self-sealing breakaway valve used at the tank-to-line attachment if 
there is danger of the tank being torn free of the supporting structure? 

69. Are vent lines routed inside the fuel tank in such a manner that spillage 
cannot continue after a rollover accident? 

70. If an antispillage vent valve is used inside the tank in lieu of the above 
items, will the valve remain fully open during all normal flight conditions? 

71. Will the vent valve close in the extreme attitudes that will occur during a 
rollover? 

72. Will the vent valve possess adequate venting cap ability under critical 
icing conditions in flight? 

73. If the fuel system is to be pressure refueled, is a bypass system provided 
in case of tank overpressurization? 

74. Is any spillage due to tank overpressurization released away from aircraft 
occupants and ignition sources? 


6.9.2 Oil and Hydraulic System Design Checklist 
6.9.2. 1 Oil Tanks and Hydraulic Reservoirs 

1. Are the tanks and reservoirs located as far as possible from anticipated 
impact areas, occupiable areas, large weight masses, and primary 
ignition sources? 

2. Are the tanks and reservoirs located as high up in the structure as 
possible? 

3. Are the tanks and reservoirs located where there is no danger of puncture 
from a collapsing landing gear? 

4. Are the tanks and reservoirs located where transmissions, engines, and 
similar massive components will not crush them during a crash? 





5 Are the tanks and reservoirs relatively safe from penetrative damage by 
structural stringers and stiffeners? 

6. Can the oil tanks displace in the airframe structure and still not leak 
around the filler area, the fluid line entry and exit, the quantity indicator, 
and the tank-to-structure attachment points? 

7. Are the hydraulic reservoirs constructed and mounted to withstand 30-G 
forces applied in any direction? 

6. 9. 2. 2 Oil and Hydraulic Lines 

8. Are all oil and hydraulic lines made from flexible hose with a steel-braided 
outer sheath wherever possible? 

9. Do all hose assemblies meet the strength requirements listed in Table 17, 
Section 6. 2. 3.1 of the Crash Survival Design Guide (last page of this 
checklist)? 

10. Can all hoses elongate 20% without the hose assemblies spilling fluid? 

11. Is coiled metal tubing used in areas where flexible hose cannot be used, 
but large structural deformations are expected? 

12. Has the number of fluid lines in the engine compartment been held to a 
minimum? 

13. Are fluid lines routed along heavier structural members wherever 
possible? 

14. Are fluid lines routed as far as possible from occupiable areas and 
electrical compartments? 

15. Are fluid lines routed as far as possible from all electrical equipment and 
wires? 

16. Are fluid lines routed away from areas where large structural damage is 
likely during a crash? 

17 Are fluid lines routed away from the exhaust system and high- 
temperature heating ducts? 

18. Are the fluid system lines designed with as few fittings as possible? 
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19. Are the fluid system lines designed so that continuous hoses are run 
through bulkheads rather than attached to the bulkheads with fittings? 

20. Are self-sealing breakaway valves used wherever a fluid line goes through 
a firewall or a bulkhead or is attached to the bulkhead? 

21. Are self-sealing breakaway valves used at all points in the fluid lines 
where aircraft structural deformation could lead to line failure? 

22. Are fluid line supports frangible to ensure release of the line during crash 
impact? 

23. Are uncut lines running through bulkheads stabilized by frangible panels? 

6.9.2.3 Oil and Hydraulic System Components 

24. Are all oil and hydraulic system components located as far as possible 
from anticipated impact areas, occupiable areas, and electrical 
compartments? 

25. Are the components located in the engine compartment restricted to 
those absolutely necessary for engine operation? 

26. Can the construction and mounting of all system components withstand 
30-G forces applied in any direction without leakage? 

6. 9. 2. 4 Oil Coolers 

27. Is the oil cooler located outside of the engine compartment? 

28. Is the oil cooler located as far as possible from anticipated impact areas, 
occupiable areas, and other potentially injurious components? 

29. Can the oil cooler and connecting lines experience considerable 
deformation without leaking? 

30. Can the oil cooler mounting withstand 30-G forces applied in any 
direction? 

6.9.3 Ignition Source Control Checklist 


6.9.3.1 Electrical Systems 

1 . Are wires routed as high up in the structure as possible? 



2. Are wires routed away from areas of anticipated structural damage, i.e., 
landing gear failure, nose crush-in, etc.? 

3. Are wires routed above or away from flammable fluid lines? 

4. Are all wires routed through the structure so that extensive structural 
collapse or displacement can take place without breaking wiring? 

5. Are wire bundles supported at frequent intervals by frangible attachments 
to the aircraft structure? 

6. Are wires shielded by felt or similar protective covers in areas where 
crushing is likely? 

7. Are wires to electrically operated boost pumps 20% to 30% longer than 
necessary? 

8. Is all electrical wiring going through the fuel tank compartments 
shrouded? 

9. Is wiring in the fuel tank compartment routed as high as possible in the 
compartment? 

10. Are electrical wires in the fuel tank compartment 20% to 30% longer than 
necessary? 

11. Are batteries, generators, and inverters located in areas relatively free 
from structural collapse? 

12. Are batteries, generators, and inverters located as far as possible from 
flammable fluids? 

13. Are batteries and generators (unless engine mounted) housed in 
compartments built into the airframe? 

14. Are battery, inverter, and generator mountings capable of withstanding a 
30-G force applied in any direction? 

15. Are the wires connecting the generator, battery, and inverter into the 
system located in relatively crush-free areas? 

16. Are light bulbs and attaching wires on lower airframe surfaces designed 
to readily displace, rather than remain stationary and be broken? 

17. Are all electrical compartments lined with a tough, nonconductive 
paneling? 
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6. 9. 3. 2 Shielding 

18. Are fuel tanks isolated from the occupants by a minimum of two spillage 
barriers? 

19. Are firewalls designed to withstand all survivable crash impacts without 
losing their structural integrity or sealing ability? 

20. Are drainage holes located in all flammable fluid tank compartments? 

21 . Is the hot metal of the engine shielded from flammable fluid spillages? 
6.9.4 Interior Materials Selection Checklist 


1. Do all interior materials meet the flammability requirements specified in 
the current Federal Air Regulation? 

2. Do all interior materials produce the lowest possible amount of smoke 
and toxic gases as specified in the current Federal Air Regulations? 
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